Security readout for executives and security teams
Plain-English summary
Older Nagios XI installations bundled a setup script that updates system scheduled tasks with elevated rights. A logged-in user on the same server could trick that script during a brief timing window to run their own commands as a privileged account. The vendor fixed this in Nagios XI 2011R1.9, so the practical concern is patching legacy monitoring servers and limiting who can log in locally.
Executive priority
Moderate-to-high priority for any business still running legacy Nagios XI. The flaw does not allow remote takeover by itself, but it lets an insider or a foothold attacker become root on the monitoring server, which often holds credentials and visibility into the rest of the estate. Schedule the upgrade in the next maintenance window and confirm coverage with IT operations.
Technical view
A time-of-check/time-of-use race (CWE-367) in Nagios XI crontab install scripts prior to 2011R1.9 lets a local low-privileged user manipulate filesystem state between validation and use, causing the privileged installer to act on attacker-controlled files or commands. Missing synchronization and final-path validation enable local privilege escalation. CVSS 4.0 base 7.3 reflects local vector, high attack complexity, low privileges required, and high confidentiality, integrity, and availability impact on the host.
Likely exposure
Exposure is limited to organizations still operating Nagios XI builds older than 2011R1.9 where untrusted or low-privileged users can obtain a local shell on the monitoring host. Internet-only attackers cannot reach the flaw without first gaining local access. Monitoring servers reachable by many internal accounts, shared admin hosts, or legacy appliances that were never upgraded carry the highest residual risk.
Exploitation context
No public reports of in-the-wild exploitation are cited and the CVE is not listed in CISA KEV. The vulnerability requires local access, low privileges, and winning a race condition, which the CVSS vector marks as high attack complexity. The VulnCheck advisory documents the class of issue but neither source bundled here confirms active exploitation or a public weaponized exploit.
Researcher notes
Classic CWE-367 TOCTOU in privileged install/update logic touching crontab paths. Look for non-atomic sequences where the script validates a path or file and then acts on it without holding it open or using a safe API, and for predictable temp paths writable by low-privileged users. The CVSS 4.0 vector (AV:L/AC:H/PR:L) signals reliable exploitation likely needs careful timing or filesystem priming. VulnCheck advisory is the most detailed third-party reference in the bundle.
Mitigation direction
- Upgrade Nagios XI to 2011R1.9 or any current supported release per vendor changelog.
- Restrict interactive and SSH access on Nagios XI hosts to trusted administrators only.
- Audit local accounts and remove unused shells on monitoring servers.
- Enforce least privilege and separate duties between monitoring operators and host admins.
- Where immediate patching is not possible, consult Nagios support for interim guidance.
Validation and detection
- Identify Nagios XI version on each instance and compare against 2011R1.9 fix line.
- Inventory which user accounts can log in locally to Nagios XI servers.
- Review crontab and installer-related file permissions and ownership for anomalies.
- Check host logs and EDR for suspicious local privilege changes around cron updates.
- Confirm patched build is in place after upgrade and rerun version validation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-367: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2011-10035 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
7.3HighVector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nagios.com/changelog/nagios-xi/CVE reference · release-notes, patch
- https://www.vulncheck.com/advisories/nagios-xi-race-conditions-in-crontab-install-script-lpeCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use (TOCTOU) Race Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.