CVE-2009-2288

CVE-2009-2288 describes a critical command injection vulnerability in Nagios versions prior to 3.1.1, specifically within the statuswml.cgi script. This flaw allows unauthenticated remote attackers to execute arbitrary operating system commands by injecting shell metacharacters into the ping or Traceroute parameters. With a CVSS score of 7.5 (High) and an EPSS score of 0.933, this vulnerability is easily exploitable over the network with low attack complexity, leading to potential compromise of confidentiality, integrity, and availability. Exploit code is publicly available, including multiple Metasploit modules and entries in ExploitDB, indicating a high likelihood of exploitation. Despite its age, the high EPSS score suggests a significant threat, though there is no evidence of active exploitation in the wild or community discussion.