Junglewise Threat Intelligence

CVE-2021-25298: Nagios XI OS Command Injection

CVE-2021-25298 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2022-01-18

Technologies: Nagios XI. Vendors: Nagios.

Executive brief

Nagios XI version 5.7.5 is vulnerable to OS command injection via the cloud-vm.inc.php component. An authenticated attacker can trigger this vulnerability through a single crafted HTTP request due to improper sanitization of user-controlled input.

Affected products

  • Nagios Nagios XI 5.7.5

Timeline

  • 2021-02-18: disclosed: Initial analysis by NIST
  • 2022-01-18: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

Related threats