CVE-2009-2288

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via...

7.5 HighPublic exploitFix available

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

Exploit likelihood

83.5%Up 1.9 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

Record: CVE-2009-2288
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-78
Updated: 2026-11-02

CVE List No score

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

Record: CVE-2009-2288
Updated: 2026-11-02

EUVDEUVD-2009-2284 No score

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

Record: EUVD-2009-2284
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3j95-hrrj-gfw8 No score

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via...

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

Record: GHSA-3j95-hrrj-gfw8
Weakness: CWE-78
Updated: 2026-11-02

Affected products

nagios

Affected packages

Affected packages
Package	Affected	Fixed
`nagios3` Debian:5.0	before 3.0.6-4~lenny2, plus listed versions 3.0.6-33.0.6-4~lenny1	3.0.6-4~lenny2
`nagios2` Debian:4.0	before 2.6-2+etch3, plus listed versions 2.6-2+etch12.6-2+etch2	2.6-2+etch3
`nagios` Red Hat:hpc_solution:1.0	before 0:2.12-3.el5	0:2.12-3.el5
`nagios-debuginfo` Red Hat:hpc_solution:1.0	before 0:2.12-3.el5	0:2.12-3.el5
`nagios-devel` Red Hat:hpc_solution:1.0	before 0:2.12-3.el5	0:2.12-3.el5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Nagios3 - 'statuswml.cgi' 'Ping' Command Execution (Metasploit)	2010-07-14
Exploit-DB	Nagios 3.0.6 - 'statuswml.cgi' Arbitrary Shell Command Injection	2009-05-22
Exploit-DB	Nagios3 - 'statuswml.cgi' Command Injection (Metasploit)	2009-10-30
Metasploit	Nagios3 statuswml.cgi Ping Command Execution	2009-06-22

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-2288 is a high vulnerability (CVSS 7.5) in Nagios, published July 1, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 83.5%, the 99th percentile. Fixed in nagios3 3.0.6-4~lenny2.

References

Show 14 moreShow less