CyberRota Analysis
AI-GeneratedNagios Core versions prior to 4.5.13 and Nagios XI versions before 2026R1.5 are vulnerable to a cross-site request forgery (CSRF) flaw in cmd.cgi, which can be exploited when the Cookie header is absent. This vulnerability allows attackers to execute Nagios commands on behalf of authenticated users by manipulating the POST body with matching form IDs. Organizations using these versions of Nagios should prioritize patching to mitigate potential unauthorized command execution risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a currently authenticated user.