PT-2025-44503 · Nagios Enterprises · Nagios Xi

Exodus Intelligence · Published 2025-10-30 · Updated 2025-10-30 · CVE-2024-14004

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.2

Description Nagios XI versions prior to 2024R1.2 have a privilege escalation issue related to how NagVis configuration data (specifically, nagvis.conf) is handled. An authenticated user may be able to gain higher-level access on the Nagios XI system by manipulating NagVis configuration data or exploiting inadequately validated configuration settings.

Recommendations Update to version 2024R1.2 or later.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-14535

CVE-2024-14004

Affected Products

Nagios Xi

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-14004 · Security Note
• https://osv.dev/vulnerability/CVE-2024-14004 · Vendor Advisory
• https://nagios.com/changelog/nagios-xi · Patch
• https://bdu.fstec.ru/vul/2025-14535 · Security Note
• https://twitter.com/CVEnew/status/1984015868104147353 · Twitter Post
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://vulncheck.com/advisories/nagios-xi-privilege-escalation-via-nagvis-configuration · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44503?fts[value]=CVE-2024-14004 · Note