PT-2025-44522 · Nagios Enterprises · Winrm Plugin+1

Published 2025-10-30 · Updated 2025-10-31 · CVE-2025-34284

Positive Technologies · (AI Summary)

CVSS v4.0

9.4

Critical

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R2

Description Nagios XI versions prior to 2024R2 have a command injection issue in the WinRM plugin. A lack of proper validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters into backend command invocations. Successful exploitation can lead to arbitrary command execution with the privileges of the Nagios XI web application user. This could allow attackers to modify configuration, steal data, disrupt monitoring, or execute commands on the host operating system. The vulnerable component is the WinRM plugin, and the issue stems from insufficient validation of user-supplied parameters.

Recommendations Update Nagios XI to version 2024R2 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-13625

CVE-2025-34284

Affected Products

Nagios Xi

Winrm Plugin

References · 10

• https://osv.dev/vulnerability/CVE-2025-34284 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34284 · Security Note
• https://bdu.fstec.ru/vul/2025-13625 · Security Note
• https://nagios.com/changelog/nagios-xi · Patch
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1984073210447515943 · Twitter Post
• https://vulncheck.com/advisories/nagios-xi-authenticated-command-injection-via-winrm-plugin · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44522 · Note
• https://twitter.com/CVEnew/status/1984012702843281448 · Twitter Post
• https://t.me/CVEtracker/36244 · Telegram Post