← Vulnerability feed

Vulnerability record · CVE-2020-28904 · published 24 May 2021

CVE-2020-28904: Nagios fusion improper privilege management vulnerability

Nagios · Fusion

Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code.

9.8 CVSS 3.1 Critical EPSS 3.6% · top 10.9% CWE-269 · Improper privilege management
9.8CVSS 3.1 base score, v2 7.5
3.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.ht Third Party AdvisoryVDB Entry
https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ ExploitThird Party Advisory
https://www.nagios.com/downloads/nagios-xi/change-log/ Release NotesVendor Advisory
http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.ht Third Party AdvisoryVDB Entry
https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/ ExploitThird Party Advisory
https://www.nagios.com/downloads/nagios-xi/change-log/ Release NotesVendor Advisory

Track CVE-2020-28904 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-28907Nagios fusion improper certificate validation vulnerabilityIncorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors rel…EPSS 3.4%9.8CVE-2020-28908Nagios fusion command injection vulnerabilityCommand Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios.EPSS 5.7%9.8CVE-2020-28900Nagios fusion insufficient verification of data authenticity vulnerabilityInsufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges…EPSS 2.4%9.8CVE-2020-28901Nagios fusion command injection vulnerabilityCommand Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt compone…EPSS 9.1%9.8CVE-2020-28902Nagios fusion command injection vulnerabilityCommand Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.EPSS 6.4%8.8CVE-2020-28906Nagios fusion incorrect default permissions vulnerabilityIncorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged…EPSS 4.7%8.8CVE-2020-28909Nagios fusion incorrect permission assignment vulnerabilityIncorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges use…EPSS 5.1%8.8CVE-2020-28905Nagios fusion code injection vulnerabilityImproper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination.EPSS 26%

Source: NIST National Vulnerability Database (record CVE-2020-28904), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.