PT-2025-44502 · Nagios Enterprises · Nagios Xi

Exodus Intelligence · Published 2025-10-30 · Updated 2025-10-30 · CVE-2024-14003

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.2

Description The software contains a flaw due to insufficient validation of inbound NRDP (Nagios Remote Data Processor) request parameters. This allows crafted input to reach command execution paths, potentially enabling an attacker to execute arbitrary commands on the underlying host in the context of the web/Nagios service. The issue affects the NRDP server plugins.

Recommendations Update to version 2024R1.2 or later.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-14305

CVE-2024-14003

Affected Products

Nagios Xi

References · 8

• https://bdu.fstec.ru/vul/2025-14305 · Security Note
• https://nagios.com/changelog/nagios-xi · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-14003 · Security Note
• https://osv.dev/vulnerability/CVE-2024-14003 · Vendor Advisory
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44502?fts[value]=CVE-2024-14003 · Note
• https://twitter.com/CVEnew/status/1984015863654064166 · Twitter Post
• https://vulncheck.com/advisories/nagios-xi-rce-via-nrdp-server-plugins · Note