CVE-2025-34227

high

Description

Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.

References

Advisories
Exploits

https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection

https://www.nagios.com/products/security/

https://www.nagios.com/changelog/

https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/

Details

Source: Mitre, NVD

Published: 2025-09-25

Updated: 2025-10-14

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.6

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.26242