CVE-2009-2288: Nagios

High severity, CVSS 7.5. EPSS: 83.5% chance of exploitation in the next 30 days.

statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

Affected products

• Nagios Nagios: up to and including 3.1.0; version 1.0 only; version 1.0b1 only; version 1.0b2 only; version 1.0b4 only; version 1.1 only; …

Published 2009-07-01. Last modified 2026-06-16.