PT-2021-7646 · Nagios Xi · Nagios Xi

Fs0C-Sh + 1 · Published 2021-02-13 · Updated 2025-11-03 · CVE-2021-25296

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios XI version xi-5.7.5

Description The issue is related to OS command injection due to improper sanitization of authenticated user-controlled input by a single HTTP request. This can lead to OS command injection on the Nagios XI server. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php.

Recommendations For Nagios XI version xi-5.7.5, as a temporary workaround, consider disabling access to the vulnerable file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php until a patch is available. Restrict access to the Windows WMI configuration wizard to minimize the risk of exploitation. Avoid using the Windows WMI configuration wizard until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-00810

CVE-2021-25296

Affected Products

Nagios Xi

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_configwizards_authenticated_rce.rb · Exploit
• 🔥 https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md · Exploit
• 🔥 http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html · Exploit
• 🔥 https://assets.nagios.com/downloads/nagiosxi/versions.php · Exploit
• 🔥 https://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html · Exploit
• 🔥 https://fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and · Exploit
• https://bdu.fstec.ru/vul/2023-00810 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-25296 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25296 · Vendor Advisory
• https://t.me/aptreports/4510 · Telegram Post
• https://t.me/cvenotify/9951 · Telegram Post
• https://t.me/cibsecurity/23591 · Telegram Post
• https://t.me/cveNotify/141316 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25296 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note