CVE-2012-10029

HIGH

Nagios XI Network Monitor <1.3 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2012-10029. PoCs published by Metasploit, including Metasploit module exploits/unix/webapp/nagios_graph_explorer.

AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Nagios XI Network Monitor's Graph Explorer component. It authenticates as a user and injects a payload into the 'host' parameter of visApi.php, leading to remote code execution.

Description

Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized parameters such as `host`, resulting in remote code execution.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremoteunix
https://www.exploit-db.com/exploits/23227

This Metasploit module exploits a command injection vulnerability in Nagios XI Network Monitor's Graph Explorer component. It authenticates as a user and injects a payload into the 'host' parameter of visApi.php, leading to remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Nagios XI Network Monitor Graph Explorer Component prior to 1.3
Auth required
Prerequisites: Valid credentials for Nagios XI · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/nagios_graph_explorer.rb

This Metasploit module exploits a command injection vulnerability in Nagios XI's Graph Explorer component (CVE-2012-10029). It authenticates as a user, then injects a payload via the 'host' parameter in visApi.php, leading to remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Nagios XI Network Monitor Graph Explorer Component prior to 1.3
Auth required
Prerequisites: Valid Nagios XI credentials · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v4 8.6
EPSS 0.7210
EPSS Percentile 98.8%
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
Nagios Enterprises/Nagios XI Graph Explorer < 1.3
Published Aug 05, 2025
Tracked Since Feb 18, 2026