PT-2025-44470 · Nagios Enterprises · Nagios Xi

Christian Weiler · CVE-2020-36867 · Published 2025-10-30 · Updated 2025-10-30

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.7.3

Description Nagios XI versions prior to 5.7.3 contain a command injection issue in the report PDF download/export functionality. Insufficient validation or improper escaping of user-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities allows an authenticated attacker who can trigger PDF exports to inject shell metacharacters or arguments.

Recommendations Update to version 5.7.3 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-14422

CVE-2020-36867

Affected Products

Nagios Xi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-36867 · Security Note
• https://bdu.fstec.ru/vul/2025-14422 · Security Note
• https://nagios.com/changelog/nagios-xi · Patch
• https://osv.dev/vulnerability/CVE-2020-36867 · Vendor Advisory
• https://vulncheck.com/advisories/nagios-xi-command-injection-in-report-pdf-download · Note
• https://twitter.com/CVEnew/status/1984015877881106498 · Twitter Post