PT-2021-7665 · Nagios Xi · Nagios Xi

Published 2021-02-13 · Updated 2025-11-03 · CVE-2021-25298

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios XI version xi-5.7.5

Description The issue is related to OS command injection due to improper sanitization of authenticated user-controlled input by a single HTTP request. This can lead to OS command injection on the Nagios XI server. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.

Recommendations For Nagios XI version xi-5.7.5, consider disabling access to the vulnerable file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php until a patch is available. Restrict access to the cloud-vm.inc.php file to minimize the risk of exploitation. Avoid using the affected HTTP request endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-01120

CVE-2021-25298

Affected Products

Nagios Xi

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_configwizards_authenticated_rce.rb · Exploit
• 🔥 https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md · Exploit
• 🔥 http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html · Exploit
• 🔥 https://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html · Exploit
• 🔥 https://fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25298 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25298 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01120 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25298 · Note
• https://assets.nagios.com/downloads/nagiosxi/versions.php · Note
• https://t.me/cvenotify/43912 · Telegram Post
• https://t.me/cveNotify/141318 · Telegram Post
• https://t.me/cvenotify/45238 · Telegram Post
• https://t.me/cibsecurity/23596 · Telegram Post