CVE-2024-24402

criticalpriority · attend · 50EPSS 0.034 · 89 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

3.40% (89th) EPSS

CVSS 9.8 · critical

Is it mine?

4 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–critical · 3.5–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.13.5lowAV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-269USCWE-79US

exploits (1)

Public proof-of-concept and weaponised exploit code.

MAWK0235/CVE-2024-24402Priv esc in Nagios 2024R1.01PoC · poc_in_github

affected products (4)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
n/a n/aall versionsenisa_euvdEU
Nagios Enterprises LLC Nagios XI≤ 2024R1.0.2fstec_bduRU
nagios nagios xi= 2024nvdUScpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-0458Nagios Enterprises Nagios XI: Mehrere SchwachstellenDeutsch2024-02-21csaf · cert_bundDE
Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Nagios Enterprises Nagios XI ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern oder einen Cross-Site-Scripting (XSS)-Angriff durchzuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd cert_bund NVD CVE.org MITRE

published 2024-02-26modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan