CVE-2020-28907

Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh.

• CWE-295

• http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/Exploit, Third Party Advisory
• https://www.nagios.com/downloads/nagios-xi/change-log/Release Notes, Vendor Advisory
• http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/Exploit, Third Party Advisory
• https://www.nagios.com/downloads/nagios-xi/change-log/Release Notes, Vendor Advisory

Published

May 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28901Command Injection in Nagios Fusion 4.1.8 and earlier allows …9.8
• CVE-2020-28902Command Injection in Nagios Fusion 4.1.8 and earlier allows …9.8
• CVE-2020-28903Improper input validation in Nagios Fusion 4.1.8 and earlier…6.1
• CVE-2020-28904Execution with Unnecessary Privileges in Nagios Fusion 4.1.8…9.8
• CVE-2020-28905Improper Input Validation in Nagios Fusion 4.1.8 and earlier…8.8
• CVE-2020-28906Incorrect File Permissions in Nagios XI 5.7.5 and earlier an…8.8
• CVE-2020-28908Command Injection in Nagios Fusion 4.1.8 and earlier allows …9.8
• CVE-2020-28909Incorrect File Permissions in Nagios Fusion 4.1.8 and earlie…8.8
• CVE-2020-2891Vulnerability in the Oracle Financial Services Liquidity Ris…7.1
• CVE-2020-28910Creation of a Temporary Directory with Insecure Permissions …9.8
• CVE-2020-28911Incorrect Access Control in Nagios Fusion 4.1.8 and earlier …6.5
• CVE-2020-28912With MariaDB running on Windows, when local clients connect …7