Nagios XI CVE-2025-67255

Requires a valid authenticated Nagios XI session of any privilege level (PR:L - a standard low-privileged operator account suffices; no admin role needed) and access to the web-based Dashboard functionality where the unfiltered parameters reside. No user interaction with a second victim is required (UI:N). The primary limiting factor is the authentication requirement: an attacker must first obtain credentials, so exposure is highest where Nagios XI is internet-facing, has many user accounts, or permits self/guest registration. Exploitation targets the specific affected build (2026R1.0.1 build 1762361101) in what appears to be a default Dashboard configuration.

This is a genuine mid-to-high operational priority rather than inflated-CVSS noise, but it is not an emergency. The official CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a remotely reachable, low-complexity SQL injection that requires only a valid low-privileged authenticated account - a realistic condition in multi-user Nagios XI monitoring deployments where many operators hold logins. Signals partially diverge: the 8.8 CVSS is high, but EPSS is modest at 1.10% (65th percentile), indicating meaningful-but-not-widespread exploitation probability, and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. A GitHub reference to a security researcher's repository (YongYe-Security/NagiosXI) suggests public exploit/PoC material likely exists, which typically raises near-term risk above what EPSS alone implies; however, the input contains no explicit PoC flag, so this should be verified rather than treated as confirmed. Net: prioritize patching for internet-exposed or widely-accessed Nagios XI instances, but this reads as a credentialed-attacker / insider-reachable SQLi, not a mass-exploited unauthenticated zero-day.

An attacker with any valid Nagios XI account (or who has phished/reused low-privilege operator credentials) logs into the web interface and submits a crafted value in a vulnerable Dashboard parameter. Because the parameter is not properly filtered, the input is interpreted as SQL, letting the attacker read or modify the backend database - potentially extracting credential hashes or escalating to administrative control. Public exploit code for Nagios XI SQLi appears to be referenced on GitHub, lowering the skill barrier.