CVE-2020-28901

CRITICAL 9.8CVE-2020-28901 · Published 24/05/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
fusion nagios	`≤ 4.1.8`	No fix yet

Description

Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php.

References

packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html · Third Party Advisory
skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you · Exploit
nagios.com/downloads/nagios-xi/change-log · Release Notes

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free