CVE-2019-15949: Nagios XI getprofile.sh command injection allows root code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityA remotely reachable, authenticated flaw that yields root code execution, is in CISA KEV, and has very high EPSS probability with public exploits.

What it is

Nagios XI before 5.6.6 runs the getprofile.sh script as root through a passwordless sudo entry when a system profile is downloaded. Because that script executes check_plugin, which is owned by the nagios user, anyone who can modify plugins through the web interface or who holds the nagios account on the server can insert commands that run as root. This turns a low-privilege foothold into full root compromise of the monitoring server.

Impact

An attacker with plugin-modification rights or the nagios local account gains arbitrary command execution as root, giving complete control of the Nagios XI host and any credentials or monitored systems it manages.

Attack surface

Reached over the network through the Nagios XI web interface (profile.php?cmd=download) or via local access as the nagios user. It requires authentication with plugin-modification permissions or the nagios account; no user interaction beyond triggering the profile download is needed.

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action to patch, and EPSS 30-day probability is 0.77039 (99.5th percentile). Multiple public exploit references exist, including a dedicated GitHub root-RCE exploit, so exploitation is mature and widespread.

What to do

• Upgrade Nagios XI to 5.6.6 or later immediately.
• Restrict plugin-modification permissions to the smallest possible set of trusted administrators.
• Remove or tightly scope the passwordless sudo entry that runs getprofile.sh as root.
• Audit and lock down the nagios local account, including SSH access and file ownership of check_plugin.
• Monitor and alert on changes to check_plugin and other plugin executables.

Detection

• Alert on modifications to check_plugin or other plugin files owned by the nagios user.
• Monitor web logs for profile.php?cmd=download requests, especially from unexpected accounts or IPs.
• Audit sudo and process logs for getprofile.sh executions and child processes running as root.
• Watch for unexpected root-level command execution or reverse shells originating from the Nagios XI host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.