CVE-2016-9565

CVE-2016-9565 is a critical vulnerability affecting Nagios Core versions prior to 4.2.2, stemming from an incomplete fix for a previous flaw in the MagpieRSS component. This vulnerability allows unauthenticated remote attackers to achieve arbitrary file read or write access, potentially leading to arbitrary code execution, by spoofing a malicious response from the Nagios RSS feed server. With a CVSS score of 9.8 (Critical) and a FAUCET Risk Score of 97/100, it presents a severe threat due to its network-based attack vector and low attack complexity, enabling full compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, an exploit for arbitrary code execution is publicly available on ExploitDB, and the vulnerability has garnered community discussion and media coverage, indicating its significance.