CVE-2021-25296: Nagios XI Windows WMI Config Wizard OS Command Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with public exploit code and a very high EPSS score, and it yields remote command execution on a monitoring server.

What it is

Nagios XI 5.7.5 fails to sanitize authenticated user input in the windowswmi config wizard file, allowing OS command injection. Because the affected component runs on the Nagios XI server, successful exploitation gives command execution in the context of the web server.

Impact

An authenticated attacker can execute arbitrary operating system commands on the Nagios XI server, leading to full compromise of the monitoring host and any credentials or data it holds.

Attack surface

Reachable over the network through a single HTTP request to the windowswmi config wizard; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N).

Exploitation

CVE-2021-25296 is listed in CISA KEV with a 2022-01-18 addition date, and public exploit references plus a Metasploit module exist; EPSS 30-day probability is 0.72182 (99.4th percentile).

What to do

• Upgrade Nagios XI to a version later than 5.7.5 per the vendor versions page.
• Restrict access to the Nagios XI web interface to trusted administrative networks.
• Review and remove unnecessary accounts with access to config wizards.
• Monitor for unexpected child processes spawned by the Nagios XI web server.

Detection

• Alert on HTTP requests to /nagiosxi/includes/configwizards/windowswmi/windowswmi.inc.php with shell metacharacters in parameters.
• Hunt for command shells or unusual binaries spawned by the Nagios XI web server user.
• Correlate Nagios XI web logs with process creation events on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.