CVE-2020-5792: Nagios XI argument injection enables arbitrary file write and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.2 with high confidentiality, integrity and availability impact, public exploit code, and very high EPSS, though exploitation requires an authenticated admin account.

What it is

Nagios XI 5.7.3 fails to neutralize argument delimiters in a command, allowing an authenticated admin to inject arguments. This lets the attacker write to arbitrary files and ultimately execute code as the apache user.

Impact

An attacker gains arbitrary file write and remote code execution with the privileges of the apache user. This can lead to full compromise of the Nagios XI host and any data or credentials it holds.

Attack surface

Reachable over the network via the Nagios XI web interface; the CVSS vector requires high privileges (PR:H) and no user interaction (UI:N). The attacker must already hold an authenticated admin account.

Exploitation

Public exploit code is referenced by Packet Storm and Tenable, and EPSS is 0.60966 (99.1st percentile), indicating high likelihood of exploitation. It is not listed in CISA KEV and no ransomware groups are documented using it.

What to do

• Upgrade Nagios XI to a version later than 5.7.3 that fixes the argument injection.
• Restrict admin accounts to the minimum necessary personnel and enforce strong authentication.
• Limit network exposure of the Nagios XI web interface to trusted management networks.
• Monitor and audit admin-level actions for unexpected command or file operations.

Detection

• Review Nagios XI web server and application logs for admin requests containing shell metacharacters or unexpected argument delimiters.
• Monitor for new or modified files in web-accessible directories and other paths writable by the apache user.
• Alert on child processes spawned by the Nagios XI web server (apache) that are not part of normal operation.
• Track use of admin accounts outside normal working hours or from unusual source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.