Skip to content
OpenAdvisories
High NCSC-2025-0349 6 CVEs

Kwetsbaarheden verholpen in Nagios XI

Published Nov 3, 2025 · Updated Nov 3, 2025 · nl

Vendor: Nagios Enterprises, LLC. Product: Nagios XI

Summary

Nagios heeft kwetsbaarheden verholpen in Nagios XI (Versies voor 2024R1.4.2 en 2024R2).

Details

Interpretaties
De kwetsbaarheden omvatten een remote code execution kwetsbaarheid binnen de Business Process Intelligence component, onvoldoende permissies op systemd unit bestanden, ongeautoriseerde toegang tot API-sleutels, een command injection kwetsbaarheid in de WinRM plugin, en een kritieke remote code execution kwetsbaarheid in de Core Config Manager. Deze kwetsbaarheden kunnen worden misbruikt door geauthenticeerde gebruikers om willekeurige code uit te voeren, wat kan leiden tot een compromittering van de systeemintegriteit en de vertrouwelijkheid van gevoelige API-gegevens. De kwetsbaarheden benadrukken de noodzaak van robuuste validatiemechanismen en correcte toegangscontrole binnen de getroffen versies.

Oplossingen
Nagios heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 6

  • Critical 9.4
    CVE-2025-34134

    Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)

    Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters (notably bpi_logfile a…

    Nagios XI
  • Critical 9.4
    CVE-2025-34284

    Nagios XI < 2024R2 Authenticated Command Injection via WinRM Plugin

    Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend comma…

    Nagios XI
  • Critical 9.4
    CVE-2025-34286

    Nagios XI < 2026R1 RCE via Run Check Command in CCM

    Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to in…

    Nagios XI
  • High 8.4
    CVE-2025-34287

    Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl

    Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-data. Because the file was writable by www-data, an attacker with web server privileges could modify…

    Nagios XI
  • High 7.1
    CVE-2025-34283

    Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes

    Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.

    Nagios XI
  • Medium 5.1
    CVE-2025-34135

    Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files

    Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit fil…

    Nagios XI

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://www.nagios.com/products/security/#nagios-xi