{"id":"CVE-2018-15708","published":"2018-11-14T18:00:00Z","modified":"2024-09-17T01:55:50Z","title":"Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP…","vendor":"Nagios","product":"Nagios XI","tier":"core","eol":null,"affectedVersions":[{"vendor":"Nagios","product":"Nagios XI","versions":["5.5.6"]}],"description":{"text":"Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in the Snoopy 1.0 component bundled with Nagios XI 5.5.6, the Nagios XI network monitoring product. An attacker can execute arbitrary commands on the affected system by sending a crafted HTTP request, and no authentication is required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:55Z"},"cvss":null,"epss":{"score":0.89362,"percentile":0.99783,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.exploit-db.com/exploits/46221/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://www.tenable.com/security/research/tra-2018-37","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/153433/Nagios-XI-Magpie_debug.php-Root-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-7578","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-7578","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46221,"url":"https://www.exploit-db.com/exploits/46221","title":"Nagios XI 5.5.6 - Remote Code Execution / Privilege Escalation","type":"webapps","platform":"linux","date":"2019-01-23","verified":false,"provenance":"source"},{"id":47039,"url":"https://www.exploit-db.com/exploits/47039","title":"Nagios XI 5.5.6 - Magpie_debug.php Root Remote Code Execution (Metasploit)","type":"remote","platform":"linux","date":"2019-06-26","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-01-23"},"metasploit":[{"name":"Nagios XI Magpie_debug.php Root Remote Code Execution","module":"exploit/linux/http/nagios_xi_magpie_debug","type":"exploit","disclosureDate":"2018-11-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_magpie_debug.rb"}],"first":{"date":"2018-11-14","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_magpie_debug.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46221/","http://packetstormsecurity.com/files/153433/Nagios-XI-Magpie_debug.php-Root-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2018-11-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-15708","provenance":"source"},{"date":"2018-11-14","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-01-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_magpie_debug.rb","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":25.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9978"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 NVD exploit link; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}