Skip to content
OpenAdvisories
High WID-SEC-2025-2459 6 CVEs

Nagios Enterprises Nagios XI: Mehrere Schwachstellen

Published Oct 30, 2025 · Updated Oct 30, 2025 · de-DE

Vendor: Nagios Enterprises, LLC. Product: Nagios XI Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Nagios Enterprises Nagios XI ausnutzen, um beliebigen Programmcode zum Teil sogar mit Administratorrechten auszuführen, um Dateien zu manipulieren, und um Informationen offenzulegen.

Product

Nagios XI ist eine auf der open-source Software Nagios basierende, aber um proprietäre Komponenten erweiterte kommerzielle Version, die eine Überwachung komplexer IT-Strukturen ermöglicht.

Vulnerabilities 6

  • Critical 9.4
    CVE-2025-34134

    Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)

    Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters (notably bpi_logfile a…

    Nagios XI
  • Critical 9.4
    CVE-2025-34284

    Nagios XI < 2024R2 Authenticated Command Injection via WinRM Plugin

    Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend comma…

    Nagios XI
  • Critical 9.4
    CVE-2025-34286

    Nagios XI < 2026R1 RCE via Run Check Command in CCM

    Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to in…

    Nagios XI
  • High 8.4
    CVE-2025-34287

    Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl

    Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-data. Because the file was writable by www-data, an attacker with web server privileges could modify…

    Nagios XI
  • High 7.1
    CVE-2025-34283

    Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes

    Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.

    Nagios XI
  • Medium 5.1
    CVE-2025-34135

    Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files

    Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit fil…

    Nagios XI

Revision history

  1. #1

    Initiale Fassung

References