The vulnerability resides in Nagios Core’s cmd.cgi script, where the cross‑site request forgery validation fails when the NagFormId cookie is missing. An attacker can construct a malicious POST request that a user’s browser will submit while the user is authenticated, allowing the attacker to execute arbitrary Nagios commands as that user. This flaw gives the attacker control over the Nagios system with the privileges of the victim, potentially leading to full system compromise, data exfiltration, or denial of service. The weakness is identified as CWE‑352.

Nagios Enterprises’ Nagios Core versions earlier than 4.5.12 are affected. The issue was present in all releases before the 4.5.12 update, which removes the flaw by requiring a valid NagFormId cookie for cmd.cgi POST requests.

With a CVSS score of 6.9 the flaw is rated as moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at the time of this analysis. The likely attack vector is a web‑based CSRF exploit that hinges on a victim having an active authenticated session to the Nagios web interface. While it does not allow an attacker to directly exploit unauthenticated users, the impact is high because any authenticated victim can be coerced into executing privileged commands.