CVE-2021-25298

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

75.15% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2022-01-18

Nuclei

high · CWE-78

Published

2021-02-15

Updated

2026-07-09

Proof-of-concept exploits (4)

• http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html
• fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
• https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasp…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25298.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_configwizar…

References

• CVE Record
• NVD entry

Related

• CVE-2021-25296
• CVE-2021-25297
• CVE-2021-25299
• CVE-2021-25310
• CVE-2021-25282
• CVE-2021-25314