What’s Vulnerable › Vulnerabilities

CVE-2013-10073: Nagios XI < 2012R1.6 Auto-Discovery Shell Command Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-30 · updated 2026-10-18
• Weakness: CWE-78

Description

Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool. User-controlled input is passed to a shell without adequate sanitation or argument quoting, allowing an authenticated user with access to discovery functionality to execute arbitrary commands with the privileges of the application service.

Affected products

• Nagios XI: before 2012; 2012-r1.0, 2012-r1.1, 2012-r1.2, 2012-r1.3, 2012-r1.4, 2012-r1.5 — fixed in 2012

How to fix

Upgrade to a fixed version: Nagios XI 2012. Check the vendor advisory for mitigations.

References

• https://www.nagios.com/changelog/nagios-xi/
• https://www.vulncheck.com/advisories/nagios-xi-auto-discovery-shell-command-injection

Get alerted when CVE-2013-10073 or the next vulnerability affects your stack