CVE-2020-5791

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 78.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-10-20 · updated 2026-06-17
Weakness: CWE-78

Description

Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.

Affected products

Nagios XI: from 5.6.0 through 5.7.3

References

http://packetstormsecurity.com/files/159743/Nagios-XI-5.7.3-Remote-Command-Injection.html
http://packetstormsecurity.com/files/162235/Nagios-XI-5.7.3-Remote-Code-Execution.html
https://www.tenable.com/security/research/tra-2020-58
http://packetstormsecurity.com/files/159743/Nagios-XI-5.7.3-Remote-Command-Injection.html
http://packetstormsecurity.com/files/162235/Nagios-XI-5.7.3-Remote-Code-Execution.html
https://www.tenable.com/security/research/tra-2020-58

Get alerted when CVE-2020-5791 or the next vulnerability affects your stack