Linuxfabrik Monitoring Plugins allowed the nagios or icinga user to run /usr/bin/apt-get as root without restricting its arguments. An attacker who already controls that monitoring account can supply the APT::Update::Pre-Invoke option, causing apt-get to execute an arbitrary command while running with root privileges, resulting in a root shell and complete compromise of the host. The vulnerability is specifically tied to the shipped Debian.sudoers policy in versions prior to 5.1.0 and applies to the check‑plugins/deb-updates/deb-updates plugin, which authorized arbitrary apt-get argument sequences instead of the intended apt-get update --quiet 2 command.

The vulnerability exists in Linuxfabrik Monitoring Plugins versions prior to 5.1.0. Systems using the Debian.sudoers policy shipped with these versions – which applies to the check‑plugins/deb-updates/deb-updates plugin – are affected. The exposed sudoers entry applies to the nagios or icinga account on Debian‑based hosts using the package.

The CVSS score of 7.0 indicates high severity. The EPSS score is <1%, but the attack requires local access to the monitoring account, which is already privileged. Because the plugin accepts arbitrary apt‑get arguments, an exploit can run any command as root, granting full control of the host. The vulnerability is listed in the vendor advisory but is not yet included in the CISA KEV catalog. The fix is released in version 5.1.0.