CVE-2016-0726: Critical severity nagios plugins vulnerability
It was found that default configuration for nagios on Fedora is administrative account with user "nagiosadmin" with fixed password "nagiosadmin" and no IP based access restriction. This information is missing in packaged README file.
Original report:
https://bugzilla.redhat.com/showbug.cgi?id=1295155
Other sources
The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0726?
CVE-2016-0726 is considered a high severity vulnerability due to the use of default credentials and lack of access restrictions.
How do I fix CVE-2016-0726?
To fix CVE-2016-0726, change the default password for the nagiosadmin account and implement IP-based access controls.
What software is affected by CVE-2016-0726?
CVE-2016-0726 affects Nagios software, specifically versions that use the default configuration.
Can CVE-2016-0726 be exploited remotely?
Yes, CVE-2016-0726 can be exploited remotely due to the lack of access restrictions for the nagiosadmin account.
Is there a patch available for CVE-2016-0726?
There is no specific patch for CVE-2016-0726; mitigation involves changing default settings and enhancing security measures.