Nagios Host Command Injection Vulnerability in Zabbix Agent Wizard Allowing Remote Code Execution

A command injection vulnerability has been identified in Nagios Host within the Zabbix Agent configuration wizard. This vulnerability allows authenticated remote attackers to execute arbitrary code on the affected system, using the service account's privileges. The issue arises from inadequate validation of user-supplied input, which is improperly sanitized before being used in system calls.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on the affected system, with the executed code running under the service account's privileges.

Remediation

Nagios has released a patch for this vulnerability. Users can refer to the Nagios XI Changelog for details on how to apply the update.