PT-2025-44504 · Nagios Enterprises · Nagios Xi

Exodus Intelligence · Published 2025-10-30 · Updated 2025-10-31 · CVE-2024-14005

Positive Technologies · (AI Summary)

CVSS v4.0

9.4

Critical

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.2

Description Nagios XI versions prior to 2024R1.2 have a command injection issue in the Docker Wizard. A lack of proper input validation allows a user with administrator privileges to inject shell metacharacters. This can lead to arbitrary command execution with the privileges of the Nagios XI web application user. The vulnerable component is the Docker Wizard, where user-supplied input is not sufficiently validated before being used in backend command invocations.

Recommendations Update Nagios XI to version 2024R1.2 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-14540

CVE-2024-14005

Affected Products

Nagios Xi

References · 9

• https://bdu.fstec.ru/vul/2025-14540 · Security Note
• https://osv.dev/vulnerability/CVE-2024-14005 · Vendor Advisory
• https://nagios.com/changelog/nagios-xi · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-14005 · Security Note
• https://twitter.com/VulmonFeeds/status/1984106482535637203 · Twitter Post
• https://twitter.com/CVEnew/status/1984015876748664944 · Twitter Post
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://vulncheck.com/advisories/nagios-xi-command-injection-via-docker-wizard · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44504?fts[value]=CVE-2024-14005 · Note