Vulnerability Report

CVE-2014-2913

RCE

Title: Nagios Remote Plugin Executor RCE

RCE

Proof Of Concept

PoC Available for CVE-2014-2913

CWE Category NVD-CWE-noinfo
Published Date May 07, 2014
Modified Date Jun 17, 2026
Exploit Status Available
Score 7.5 CVSS v2.0
Exploit Probability (EPSS)
15.31%

Vulnerability Summary

CVE-2014-2913: Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments

Impacted Vendors

N
nagios 1

Reference Links

http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166528.html http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00011.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00005.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00014.html http://seclists.org/fulldisclosure/2014/Apr/240 http://seclists.org/fulldisclosure/2014/Apr/242 http://seclists.org/oss-sec/2014/q2/154 http://seclists.org/oss-sec/2014/q2/155 http://www.securityfocus.com/bid/66969 http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166528.html http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00011.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00005.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00014.html http://seclists.org/fulldisclosure/2014/Apr/240 http://seclists.org/fulldisclosure/2014/Apr/242 http://seclists.org/oss-sec/2014/q2/154 http://seclists.org/oss-sec/2014/q2/155 http://www.securityfocus.com/bid/66969
CVSS v2.0
Source Entity [email protected]
Severity HIGH
7.5
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2014-2913 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/34461
View Code
Exploit-DB https://www.exploit-db.com/exploits/32925
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.