Shell Command Injection in Nagios XI Auto-Discovery Tool
CVE-2013-10073

8.7HIGH

Key Information:

Vendor

NagiOS

Status
Xi
Vendor
CVE Published:
30 October 2025

What is CVE-2013-10073?

Nagios XI, a widely used IT infrastructure monitoring solution, has a shell command injection vulnerability within its Auto-Discovery tool. This issue arises in versions before 2012R1.6, where user input is inadequately sanitized before being passed to a shell. As a result, authenticated users who can access discovery functionality may execute arbitrary commands with the application's service privileges. It is crucial for users to upgrade to the latest version to mitigate this risk. Additional details and patches can be found in the official release notes and third-party advisories.

Affected Version(s)

XI 0 < 2012R1.6

References

https://www.nagios.com/changelog/nagios-xi/
release-notespatch
https://www.vulncheck.com/advisories/nagios-xi-auto-disco...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

James Clawson
JSON
.
CVE-2013-10073 : Shell Command Injection in Nagios XI Auto-Discovery Tool