Back to search
CVE-2024-14008
Published: Oct 30, 2025
Modified: Nov 17, 2025
PUBLISHED
Description
Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user.
| Vendor | Product | Versions |
|---|---|---|
Nagios | XI | unknown 0 - < 2024R1.3.2 |
Weaknesses (CWE)
References
https://www.nagios.com/products/security/#nagios-xi
vendor-advisory
patch
https://www.nagios.com/changelog/nagios-xi/
release-notes
patch
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now