Security readout for executives and security teams
Plain-English summary
Nagios XI, a popular IT monitoring platform, contains a flaw in its SNMP trap configuration page that lets an already-logged-in administrator manipulate database queries. An attacker who has stolen or been given admin credentials could read, change, or destroy monitoring data. Versions before 5.7.5 are affected, and the vendor released a fixed release that resolves the issue.
Executive priority
Medium-priority patch: the flaw is serious but requires admin access, so risk is contained for organizations with disciplined credential controls. Schedule the upgrade in the next maintenance window and confirm the monitoring platform is not exposed to untrusted networks.
Technical view
CVE-2020-36869 is a CWE-89 SQL injection in the SNMP Trap Interface edit page of Nagios XI prior to 5.7.5. Authenticated administrative input is concatenated into a backend SQL query without proper sanitization, enabling unauthorized read, modification, or arbitrary SQL execution against the application database. CVSS 4.0 is 8.7 (AV:N/AC:L/PR:L/UI:N) reflecting network reach with low-privilege admin precondition.
Likely exposure
Limited to organizations running Nagios XI versions earlier than 5.7.5 with the SNMP Trap Interface enabled and reachable by users holding administrative accounts. Exposure widens where admin credentials are shared, weakly protected, or where the management UI is reachable beyond an operations network.
Exploitation context
No public evidence of active exploitation; the CVE is not in CISA KEV per the source bundle. Exploitation requires authenticated administrator-level access, which raises the bar but remains realistic where credentials are reused, phished, or recovered from prior compromises. VulnCheck has published a third-party advisory describing the issue.
Researcher notes
Authenticated SQLi reachable from the SNMP Trap Interface edit page; CWE-89 with administrative precondition (PR:L). Validate by enumerating Nagios XI builds and confirming 5.7.5 patch level. Treat any admin account compromise on unpatched instances as potential database tampering. No KEV listing and no public exploit cited in the bundle; monitor the VulnCheck advisory for any updates.
Mitigation direction
- Upgrade Nagios XI to 5.7.5 or later per the vendor changelog.
- Restrict admin UI access to a management VLAN or VPN until patched.
- Rotate Nagios XI administrator credentials and enforce MFA where supported.
- Audit and minimize the number of accounts with administrative privileges.
- Review database account permissions used by Nagios XI to limit blast radius.
Validation and detection
- Confirm installed Nagios XI version against the 5.7.5 fixed release.
- Inventory which hosts expose the SNMP Trap Interface edit page.
- Review web and database logs for anomalous admin activity on that endpoint.
- Verify network ACLs limiting reachability of the Nagios XI admin console.
- Cross-check vendor changelog and VulnCheck advisory for any updated guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-36869 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.nagios.com/changelog/nagios-xi/CVE reference · release-notes, patch
- https://www.vulncheck.com/advisories/nagios-xi-sqli-via-snmp-trap-interface-edit-pageCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.