CVE-2018-15708: Nagios XI Snoopy component allows unauthenticated remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and very high EPSS probability make this an urgent patch target.

What it is

Snoopy 1.0 as bundled in Nagios XI 5.5.6 permits remote unauthenticated attackers to execute arbitrary commands through a crafted HTTP request. The flaw is a command injection reachable without credentials, and public exploit code exists, making it a serious risk for internet-exposed Nagios XI installations.

Impact

An attacker gains arbitrary command execution on the Nagios XI host, which typically runs with high privileges and can lead to full server compromise and access to monitored infrastructure credentials.

Attack surface

Reached over the network via a crafted HTTP request to the affected Nagios XI component; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required.

Exploitation

Public exploit code is referenced on Exploit-DB, Packet Storm and Tenable, and EPSS is very high (0.894, 99.8th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade Nagios XI to a version that removes or fixes the vulnerable Snoopy 1.0 component, following the vendor's guidance.
• If immediate patching is not possible, restrict network access to the Nagios XI web interface to trusted management networks only.
• Remove or disable the Snoopy component if it is not required for monitoring operations.
• Audit the Nagios XI host for signs of compromise and rotate credentials for accounts and monitored systems it can reach.

Detection

• Monitor Nagios XI web server logs for crafted or anomalous HTTP requests targeting Snoopy-related endpoints.
• Alert on unexpected child processes spawned by the Nagios XI web server or PHP processes.
• Review host telemetry for command execution originating from the Nagios XI service account outside normal monitoring activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.