Security readout for executives and security teams
Plain-English summary
Nagios XI versions before 5.7.3 have a flaw in the report PDF export feature that lets a logged-in user trick the server into running unintended system commands. An attacker with valid credentials and access to the reporting feature could potentially take control of the monitoring server, which often holds privileged visibility into the rest of the IT environment.
Executive priority
Treat as a high-priority patch for any Nagios XI deployment because the monitoring server is a high-value target, and authenticated command execution there can pivot into broader infrastructure compromise. Schedule the upgrade in the next maintenance window and confirm exposure scope this week.
Technical view
A command injection (CWE-78) exists in the Nagios XI report PDF download/export pipeline in versions prior to 5.7.3. User-supplied values passed to the PDF helper wrapper were insufficiently validated, allowing shell metacharacter or argument injection by an authenticated user who can trigger PDF exports. CVSS 4.0 score 8.7 reflects network-reachable, low-complexity abuse with high impact to confidentiality, integrity, and availability of the host.
Likely exposure
Organizations running on-premises Nagios XI instances older than 5.7.3 with reporting enabled and any authenticated user accounts (including low-privilege monitoring users) are exposed. Risk is highest where the Nagios server is reachable from broad internal networks or has weak authentication, since it typically holds credentials and access to monitored hosts.
Exploitation context
No KEV listing and no public exploitation reporting is cited in the supplied sources. Exploitation requires authentication and access to the report export function, so this is not a pre-auth internet wormable issue, but credentialed attackers or insiders could leverage it for code execution on the Nagios host.
Researcher notes
CWE-78 in a PDF export wrapper typically points to unsanitized parameters reaching a shell-invoked helper. Validate by reviewing changes between 5.7.2 and 5.7.3 in the report/PDF code path and confirm whether the fix uses argument arrays or strict allow-listing rather than escaping. CVE was published late (2025) for a 2020-era issue, so check internal asset records for long-running unpatched hosts.
Mitigation direction
- Upgrade Nagios XI to 5.7.3 or later per vendor changelog guidance.
- Restrict Nagios XI web UI access to trusted management networks and VPN.
- Audit and remove unused or shared low-privilege Nagios accounts.
- Enforce strong authentication and unique credentials for all Nagios users.
- Monitor the Nagios host for unexpected child processes spawned from the web stack.
- If patching is delayed, limit who can access the report/PDF export functionality.
Validation and detection
- Identify the running Nagios XI version from the admin UI or version file.
- Compare against 5.7.3 and review the vendor changelog for fix confirmation.
- Inventory all Nagios XI instances, including DR and lab environments.
- Review user accounts with access to reporting and PDF export features.
- Check web and system logs for anomalous PDF export requests or shell activity.
- Confirm network exposure of the Nagios web interface from untrusted segments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-36867 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nagios.com/changelog/nagios-xi/CVE reference · release-notes, patch
- https://www.vulncheck.com/advisories/nagios-xi-command-injection-in-report-pdf-downloadCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.