What is the CVSS score of CVE-2024-33775?

CVE-2024-33775 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of Nagios XI are affected by CVE-2024-33775?

Nagios XI 2024R1.01 contains a privilege escalation vulnerability that allows any authenticated user with basic system access to gain full administrative control over the monitoring infrastructure.

Is there a public PoC exploit available for CVE-2024-33775?

Yes, a public proof-of-concept exploit is available for CVE-2024-33775. Prioritise patching immediately. EPSS: 1.6%.

How to fix or mitigate CVE-2024-33775?

Within 24 hours: Identify all systems running Nagios XI 2024R1.01 and assess their criticality and network exposure. Within 7 days: Implement strict access controls by restricting administrative access to the Nagios XI web interface to authorized personnel only using firewall rules or network segmentation, and audit all user permissions to apply least-privilege principles to eliminate unnecessary low-privilege accounts. Additionally, enable detailed logging and alerting on Dashlet submissions and Autodiscover component activity to detect exploitation attempts. Within 30 days: Monitor Nagios vendor advisories closely for patch availability, evaluate available patched versions for upgrade feasibility, and prepare a formal migration plan. In the interim, consider implementing a Web Application Firewall (WAF) to filter potentially malicious Dashlet configurations if operationally feasible.

Nagios XI CVE-2024-33775

HIGH

Improper Privilege Management (CWE-269)

2024-05-01 cve@mitre.org

Privilege Escalation Nagios Xi Nagios

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible web app, low-complexity attack, requires authenticated low-privilege account; full CIA impact post-escalation, scope unchanged within application.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 24, 2026 - 14:32 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 24, 2026 - 14:22 vuln.today

cvss_changed

Severity Changed

Aug 24, 2026 - 14:22 NVD

CRITICAL HIGH

CVSS changed

Aug 24, 2026 - 14:22 NVD

9.8 (CRITICAL) 8.8 (HIGH)

CVE Published

May 01, 2024 - 13:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet.

AnalysisAI

Privilege escalation in Nagios XI 2024R1.01 allows an authenticated low-privileged attacker to gain elevated system access by submitting a crafted Dashlet through the Autodiscover component. The vulnerability stems from improper privilege management (CWE-269), meaning the application fails to enforce appropriate access controls when processing Dashlet configurations. A public proof-of-concept exploit exists on GitHub, and the 73rd-percentile EPSS score suggests elevated real-world exploitation interest despite no current CISA KEV listing.

Technical ContextAI

Nagios XI is a widely-deployed IT infrastructure monitoring platform. The affected component is Autodiscover, a feature that likely handles automatic detection and configuration of monitored hosts and services. The attack vector is a crafted Dashlet - a modular dashboard widget in the Nagios XI UI - indicating the privilege check flaw exists within the web application layer processing Dashlet input. CWE-269 (Improper Privilege Management) indicates the root cause is not a memory-safety issue but a logic flaw: the application either fails to verify the caller's privilege level before performing a privileged operation, or it permits a low-privileged user to manipulate privilege-sensitive data structures through the Dashlet interface. The affected CPE is cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:*.

RemediationAI

Consult the Nagios XI changelog at https://www.nagios.com/changelog/#nagios-xi to identify a patched release beyond 2024R1.01 and apply it immediately; no exact fixed version is independently confirmed from the available references. If an upgrade is not immediately possible, restrict Nagios XI account provisioning to trusted administrative users only, removing or disabling any broadly shared or low-privileged accounts that do not require access. Disable or restrict access to the Autodiscover component and Dashlet functionality for non-administrative roles if the platform supports granular role-based access control configuration. Network-level controls should limit Nagios XI web interface exposure to management VLANs or VPN-only access, reducing the attacker pool to internal or authenticated-network users. Monitor Nagios XI audit logs for unexpected privilege changes or unusual Dashlet submissions.