CVE-2018-25123 - Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component

Back Back to CVE browser

HIGH

Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component

Published Oct 30, 2025

8.5

HIGH

CVSS 4.0

EPSS 0.35%

Description

Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/scripts executed with excessive privileges, allowing a local attacker with limited system access to abuse file/command execution paths or writable resources to gain elevated privileges.

Affected products

Vendor Nagios Product XI Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <5.5.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nagios

unaffected

Version	Status	Constraints
0	affected	<5.5.7

Remediation

Vendor solution

Nagios addresses this vulnerability as "Fixed privilege escalation security vulnerability in MRTG graphing component by running as nagios user/group."

Weaknesses (1)

CWE-250

Execution with Unnecessary Privileges

References (2)

https://www.nagios.com/changelog/nagios-xi/
release-notespatchRelease Notes
https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-mrtg-graphing-component
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://www.nagios.com/changelog/nagios-xi/		release-notespatchRelease Notes
https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-mrtg-graphing-component		third-party-advisoryThird Party Advisory