Nagios XI CVE-2025-34284

Exploitation requires authenticated administrator access to the Nagios XI web interface (CVSS PR:H) and use of the WinRM plugin feature - the attacker supplies parameters to the WinRM plugin containing shell metacharacters that are incorporated into backend command invocations. Limiting factors: the attacker must already hold administrator privileges (via legitimate access, credential theft, or session hijack); the WinRM plugin code path must be reachable/in use; and only versions prior to 2024R2 are affected, so patched instances are not exploitable. Because Nagios XI administrators can often already execute commands by design, the practical significance is breaking out of application-layer intent to OS command execution as the web-app user.

The CVSS 4.0 base score of 9.4 is driven largely by full compromise of both the vulnerable system and a subsequent system (VC/VI/VA:H and SC/SI/SA:H), reflecting that command injection in the WinRM plugin escapes the web application into arbitrary OS command execution on the Nagios XI host. However, the single most important mitigating signal is PR:H: the CVSS vector explicitly requires an authenticated administrator, so this is a post-authentication privilege-to-code-execution flaw, not a pre-auth internet-facing catastrophe. No EPSS score, KEV listing, or POC indicator is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the score is severity-of-outcome, not likelihood-of-mass-exploitation. Real-world priority is moderate: an attacker already needs admin on the monitoring console, and Nagios XI admins can typically already run scripts/commands by design, so the practical escalation this grants (breaking out to the underlying OS as the web-app user, potentially bypassing intended application-layer restrictions) is meaningful but bounded. Note the SSVC/threat metrics in the input are all X (Not Defined), and no EPSS was provided - exploitation-probability data is simply absent rather than low, so absence should not be read as safety.

An authenticated Nagios XI administrator (or an attacker who has phished/stolen admin credentials or ridden an admin session) configures or invokes the WinRM plugin and embeds shell metacharacters (e.g. ;, |, `, $()) into a user-supplied parameter. These characters are passed unsanitized into the backend command invocation, executing attacker-chosen commands as the Nagios XI web application user on the host OS. No public exploit code is identified in the provided data, though the flaw was reported by VulnCheck, which published a dedicated advisory.