PT-2025-44800 · Nagios Enterprises · Nagios Xi

Published 2024-05-28 · Updated 2025-11-04 · CVE-2024-13997

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.3

Description Nagios XI versions prior to 2024R1.1.3 have a flaw that allows an authenticated administrator to gain root privileges on the host system. This is achieved by exploiting the Migrate Server feature, which allows an attacker to execute actions beyond the intended security boundaries of the application, ultimately gaining full control of the operating system.

Recommendations Update Nagios XI to version 2024R1.1.3 or later.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-14477

CVE-2024-13997

Affected Products

Nagios Xi

References · 9

• https://cve.org/CVERecord?id=CVE-2024-13997 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13997 · Vendor Advisory
• https://nagios.com/changelog/nagios-xi · Patch
• https://bdu.fstec.ru/vul/2025-14477 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13997 · Security Note
• https://vulncheck.com/advisories/nagios-xi-privilege-escalation-via-migrate-server-feature-to-root-on-host · Note
• https://t.me/CVEtracker/36450 · Telegram Post
• https://vuldb.com/?id.330996 · Note
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory