CVE-2018-25123: Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-30 · updated 2026-10-18
Weakness: CWE-250

Description

Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/scripts executed with excessive privileges, allowing a local attacker with limited system access to abuse file/command execution paths or writable resources to gain elevated privileges.

Affected products

Nagios XI: before 5.5.7 — fixed in 5.5.7

How to fix

Upgrade to a fixed version: Nagios XI 5.5.7. Check the vendor advisory for mitigations.

References

https://www.nagios.com/changelog/nagios-xi/
https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-mrtg-graphing-component

Get alerted when CVE-2018-25123 or the next vulnerability affects your stack