PT-2025-39429 · Postgresql Global Development Group+3 · Postgres+3

Published 2025-09-25 · Updated 2025-09-26 · CVE-2025-34227

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2026R1

Description Nagios XI is susceptible to an authenticated command injection issue present in the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. Successful exploitation allows injection of shell characters into arguments supplied to the service, enabling the execution of arbitrary system commands on the host as the nagios user. The vulnerable wizards include MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query.

Recommendations Update to version 2026R1 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-34227

Affected Products

Mongodb

Mysql Server

Nagios Xi

Postgres

References · 9

• 🔥 https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection · Exploit
• https://osv.dev/vulnerability/CVE-2025-34227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34227 · Security Note
• https://nagios.com/products/security · Patch, Vendor Advisory
• https://vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection · Note
• https://nagios.com/changelog · Patch, Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1971450732491489773 · Twitter Post
• https://t.me/CVEtracker/33351 · Telegram Post
• https://twitter.com/CVEnew/status/1971266267530117129 · Twitter Post