Nagios XI CVE-2025-34134

Requires an authenticated user with administrative privileges in Nagios XI (PR:H) who can access the Business Process Intelligence (BPI) component and control its configuration parameters bpi_logfile and bpi_configfile. Exploitation depends on writing files with executable extensions into the webroot and having them served/executed by the web application, then using the BPI configuration editor to populate them. The principal limiting factor is the administrative authentication requirement - this is not exploitable by anonymous or low-privileged remote users; it is only reachable by (or through compromise of) a Nagios XI admin account on an instance running a version prior to 2024R1.4.2.

This is a genuinely high-severity flaw but with an important gating condition that tempers real-world urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, full VC/VI/VA:H plus subsequent-system SC/SI/SA:H) scores 9.4, and the high score is driven mainly by the scope-changing outcome - arbitrary code execution as the web application user that can be pivoted to full host compromise. The decisive limiter is PR:H: exploitation requires an already-authenticated administrative user of Nagios XI, since the vulnerable inputs (bpi_logfile, bpi_configfile) are administrator-controlled BPI configuration parameters. This makes it far more a post-authentication privilege-to-RCE escalation / malicious-or-compromised-admin scenario than an internet-wide mass-exploitation risk. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Net: real priority for organizations running affected Nagios XI where admin credentials could be phished, reused, or held by lower-trust operators, but not a drop-everything internet-perimeter emergency given the admin-authentication prerequisite. Note a conceptual mismatch to verify: the CWE is CWE-78 (OS command injection) but the described mechanism is arbitrary file creation/overwrite in the webroot with executable extensions served by the app - closer to unrestricted file upload / code injection than classic command injection.

An authenticated Nagios XI administrator (or an attacker who has phished/reused admin credentials) navigates to the Business Process Intelligence component and sets the bpi_logfile or bpi_configfile parameter to a path inside the webroot with an executable extension (e.g. a .php file). They then use the BPI configuration editor to write attacker-controlled content into that file, and request the URL so the web server executes it, yielding code execution as the Nagios XI web application user and a foothold to pivot to the host OS. No public exploit code is referenced in the provided data.