PT-2025-44510 · Nagios Enterprises · Nagios Xi

Published 2025-10-30 · Updated 2025-10-31 · CVE-2025-34134

Positive Technologies · (AI Summary)

CVSS v4.0

9.4

Critical

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.4.2

Description Nagios XI versions prior to 2024R1.4.2 have a remote code execution issue in the Business Process Intelligence (BPI) component. The issue is due to inadequate validation and sanitization of administrator-controlled BPI configuration parameters, specifically bpi logfile and bpi configfile. This allows an authenticated administrative user to create or overwrite files within the webroot and modify them using the BPI configuration editor. If these files have executable extensions and are served by the web application, arbitrary code execution can occur in the context of the Nagios XI web application user. Successful exploitation can lead to arbitrary command execution with the privileges of the Nagios XI web application user, potentially allowing further control of the host operating system.

Recommendations Update Nagios XI to version 2024R1.4.2 or later.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-14532

CVE-2025-34134

Affected Products

Nagios Xi

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-34134 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34134 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14532 · Security Note
• https://nagios.com/changelog/nagios-xi · Patch
• https://twitter.com/offseq/status/1984093159442268286 · Twitter Post
• https://twitter.com/CVEnew/status/1984015864736137527 · Twitter Post
• https://vulncheck.com/advisories/nagios-xi-rce-via-business-process-intelligence-bpi · Note
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44510?fts[value]=CVE-2025-34134 · Note