PT-2025-44505 · Nagios Enterprises · Nagios Xi

Published 2025-10-30 · Updated 2025-10-30 · CVE-2024-14006

Positive Technologies · (AI Summary)

CVSS v4.0

8.8

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.2.2

Description The application does not properly validate the user-supplied HTTP Host header when constructing URLs. This can allow a remote, unauthenticated attacker to inject a crafted Host header, potentially leading to phishing of credentials, hijacking of account recovery links, and web cache poisoning. The issue involves insufficient validation of the Host header.

Recommendations Update to version 2024R1.2.2 or later.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BDU:2025-14539

CVE-2024-14006

Affected Products

Nagios Xi

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-14006 · Security Note
• https://bdu.fstec.ru/vul/2025-14539 · Security Note
• https://osv.dev/vulnerability/CVE-2024-14006 · Vendor Advisory
• https://nagios.com/changelog/nagios-xi · Patch
• https://vulncheck.com/advisories/nagios-xi-host-header-injection · Note
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1984015874609553573 · Twitter Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44505?fts[value]=CVE-2024-14006 · Note