Every CVE Search/ Get API key

CVE-2014-2913

** DISPUTED ** Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor ...

7.5 HighPublic exploitFix availableDisputed

Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments

Exploit likelihood

15.3%Up 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments

Record
CVE-2014-2913
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments

Record
CVE-2014-2913
Updated
2026-11-02
EUVDEUVD-2014-2936 No score

Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments

Record
EUVD-2014-2936
Updated
2026-11-03
GitHub AdvisoriesGHSA-95rp-rj38-x3rc No score

** DISPUTED ** Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor ...

** DISPUTED ** Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments.

Record
GHSA-95rp-rj38-x3rc
Updated
2026-11-02
OSV No score

Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments

Record
CVE-2014-2913
Updated
2026-11-02
OSVDEBIAN-CVE-2014-2913 No score

Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments

Record
DEBIAN-CVE-2014-2913
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0217 No score

Updated nrpe packages fix CVE-2014-2913

Updated nrpe packages fix security vulnerability:

A remote, command execution flaw was discovered in Nagios NRPE when command arguments are enabled. A remote attacker could use this flaw to execute arbitrary commands (CVE-2014-2913).

Record
MGASA-2014-0217
Updated
2026-11-02
OSVopenSUSE-SU-2024:11099-1 No score

monitoring-plugins-nrpe-4.0.3-3.5 on GA media

These are all security issues fixed in the monitoring-plugins-nrpe-4.0.3-3.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11099-1
Updated
2026-11-02
OSVSUSE-SU-2024:1417-1 No score

Security update for nrpe

This update for nrpe fixes the following issues:

CVE-2014-2913: Fixed remote command execution when command arguments are enabled (bsc#1118590,bsc#874743)

Record
SUSE-SU-2024:1417-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-2913 No score

** DISPUTED ** Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments.

Record
UBUNTU-CVE-2014-2913
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nagios-nrpe
Debian:12
 before 2.15-1
2.15-1
nagios-nrpe
Debian:13
 before 2.15-1
2.15-1
nagios-nrpe
Debian:14
 before 2.15-1
2.15-1
nrpe
Mageia:3
 before 2.14-1.2.mga3
2.14-1.2.mga3
nrpe
Mageia:4
 before 2.15-2.1.mga4
2.15-2.1.mga4
nrpe
SUSE:Linux Enterprise Server 12 SP5
 before 2.15-6.6.1
2.15-6.6.1
nrpe
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 2.15-6.6.1
2.15-6.6.1
nrpe
openSUSE:Tumbleweed
 before 4.0.3-3.5
4.0.3-3.5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBNRPE 2.15 - Remote Command Execution2014-04-18
Exploit-DBNRPE 2.15 - Remote Code Execution2014-08-29

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-2913 is a high vulnerability (CVSS 7.5) in Nagios Remote Plugin Executor, published May 7, 2014. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 15.3%, the 96th percentile. Fixed in nagios-nrpe 2.15-1.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open