{"id":"CVE-2021-25298","kind":"vulnerability","aliases":["CVE-2021-25298"],"related":[],"title":"Nagios Nagios XI: Nagios XI OS Command Injection","description":"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.","summary":"Nagios XI, a server monitoring product, has an OS command injection flaw that lets input run shell commands on the server. An attacker who can reach it can run commands as the Nagios XI server process.","severity":"critical","cvss":9.0,"epss":0.73641,"exploited":true,"exploited_at":"2022-01-18T00:00:00+00:00","products":[{"name":"Nagios Nagios XI","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","nagios-xi","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor update per Nagios instructions; the fixed version is unknown from the sources.","status":"open","published_at":"2021-02-15T13:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:37+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:31:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Nagios instructions; the fixed version is unknown from the sources.","reach":"network","impact":"high","summary":"Nagios XI, a server monitoring product, has an OS command injection flaw that lets input run shell commands on the server. An attacker who can reach it can run commands as the Nagios XI server process.","category":"infrastructure","who_cares":["nagios-xi","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary OS commands on the Nagios XI server","analyst_note":"Find the affected and fixed Nagios XI versions and any auth requirement in the Nagios security advisory for CVE-2021-25298; CISA KEV lists it as exploited.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000449,"input_tokens":2807,"output_tokens":336,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected and fixed Nagios XI versions and any auth requirement in the Nagios security advisory for CVE-2021-25298; CISA KEV lists it as exploited.","search":"'-2021':10A,13A '-25298':11A,14A '/usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php':79C '5.7.5':66C 'affect':68C 'attack':48B 'authent':85C 'command':7A,35B,43B,55B,71C,100C 'control':88C 'cve':9A,12A 'due':80C 'exist':75C 'exploit':18B 'file':78C 'flaw':37B 'host':25B 'http':93C 'improp':82C 'infrastructur':19B 'inject':8A,36B,72C,101C 'input':40B,89C 'lead':97C 'let':39B 'monitor':30B 'nagio':1A,2A,4A,21B,26B,58B,62C,104C 'nagios':15A,16A 'nagios-xi':20B 'os':6A,34B,70C,99C 'process':61B 'product':31B 'reach':51B 'request':94C 'run':41B,54B 'sanit':83C 'self':24B 'self-host':23B 'server':29B,46B,60B,106C 'shell':42B 'singl':92C 'user':87C 'user-control':86C 'version':64C 'vulner':74C 'xi':3A,5A,17A,22B,27B,59B,63C,65C,105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-02-15T13:15:12+00:00","kev":{"dateAdded":"2022-01-18","dueDate":"2022-02-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-25298","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-25298","severity":null,"published_at":"2022-01-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2021-25298","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-25298","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-25298","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25298","severity":null,"published_at":"2021-02-15T13:15:12+00:00","modified_at":"2026-07-09T13:39:54+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}