← Vulnerability feed

Vulnerability record · CVE-2017-16834 · published 16 November 2017

CVE-2017-16834: Pnp4nagios incorrect permission assignment vulnerability

Pnp4nagios · Pnp4nagios

PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, which allows local users to gain privileges by leveraging access to this unprivileged account.

7.8 CVSS 3.0 High EPSS 0.36% · top 73.1% CWE-732 · Incorrect permission assignment
7.8CVSS 3.0 base score, v2 7.2
0.36%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, which allows local users to gain privileges by leveraging access to this unprivileged account.

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/lingej/pnp4nagios/issues/140 Issue TrackingPatchThird Party Advisory
https://security.gentoo.org/glsa/201806-09
https://github.com/lingej/pnp4nagios/issues/140 Issue TrackingPatchThird Party Advisory
https://security.gentoo.org/glsa/201806-09

Track CVE-2017-16834 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-38349Pnp4nagios cross-site request forgery vulnerabilityPNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26.EPSS 0.30%5.4CVE-2023-38350Pnp4nagios cross-site scripting vulnerabilityPNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26.EPSS 0.52%4.3CVE-2014-4907Op5 monitor cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to …EPSS 2.2%4.3CVE-2014-4908Pnp4nagios cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via th…EPSS 1.9%2.1CVE-2012-3457Pnp4nagios permissions and access controls vulnerabilityPNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret …EPSS 0.34%4.3CVE-2018-13374FortiOS and FortiADC access control flaw exposes LDAP credentialsFortiOS (6.0.2, 5.6.7 and earlier) and FortiADC (6.1.0, 6.0.0-6.0.1, 5.4.0-5.4.4) contain an improper access control flaw. An attacker can redirect a…KEVEPSS 38%analysed7.8CVE-2022-22960VMware Workspace ONE Access and related products local privilege escalationVMware Workspace ONE Access, Identity Manager, vRealize Automation and related products ship support scripts with incorrect permission assignments (C…KEVEPSS 36%analysed7.8CVE-2021-23874McAfee Total Protection local privilege escalation via self-defense bypassMcAfee Total Protection before 16.0.30 has an improper privilege management flaw that lets a local user bypass the product's self-defense mechanism a…KEVEPSS 1.0%analysed

Source: NIST National Vulnerability Database (record CVE-2017-16834), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.