PT-2021-7666 · Nagios Xi · Nagios Xi

Published 2021-02-13 · Updated 2025-11-03 · CVE-2021-25297

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios XI version xi-5.7.5

Description The issue is related to the Nagios XI monitoring tool and is caused by the failure to neutralize special elements used in operating system commands. This can be exploited by sending a special HTTP request, allowing an attacker to execute arbitrary commands. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Recommendations For Nagios XI version xi-5.7.5, consider disabling the switch.inc.php file or restricting access to the vulnerable configwizards directory until a patch is available. As a temporary workaround, restrict access to the affected HTTP endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-01123

CVE-2021-25297

Affected Products

Nagios Xi

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_configwizards_authenticated_rce.rb · Exploit
• 🔥 https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md · Exploit
• 🔥 http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html · Exploit
• 🔥 https://assets.nagios.com/downloads/nagiosxi/versions.php · Exploit
• 🔥 https://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html · Exploit
• 🔥 https://fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25297 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25297 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01123 · Security Note
• https://t.me/cibsecurity/23595 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/9952 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25297 · Note
• http://nagios.com · Note