CVE-2021-25297: Nagios XI switch config wizard OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is an authenticated remote OS command injection on a monitoring server, is in CISA KEV, has a very high EPSS score, and public exploit code exists.

What it is

Nagios XI 5.7.5 fails to sanitize authenticated user input in the switch configuration wizard file switch.inc.php, allowing OS command injection via a single HTTP request. Because the affected component is a monitoring server, successful exploitation can compromise the host and the infrastructure it manages.

Impact

An authenticated attacker can execute arbitrary OS commands on the Nagios XI server, gaining control of the monitoring host and potentially pivoting to monitored systems.

Attack surface

Reached over the network through the Nagios XI web interface at the switch configuration wizard endpoint. The CVSS vector indicates low privileges are required and no user interaction is needed.

Exploitation

CVE-2021-25297 is listed in CISA KEV with a due date of 2022-02-01, and EPSS shows a 30-day probability of 0.56659 (99th percentile). Multiple references are tagged Exploit, including public write-ups and a Metasploit module.

What to do

• Upgrade Nagios XI to a version later than 5.7.5 per vendor instructions.
• Restrict access to the Nagios XI web interface to trusted administrative networks.
• Review and limit accounts with access to configuration wizards, removing unused or low-privilege users.
• Monitor Nagios XI hosts for unexpected child processes or outbound connections from the web server.
• Apply the CISA KEV required action and verify remediation before the due date.

Detection

• Alert on suspicious process creation spawned by the Nagios XI web server or PHP processes.
• Monitor HTTP requests to /nagiosxi/includes/configwizards/switch/switch.inc.php for command metacharacters.
• Audit Nagios XI logs for configuration wizard activity from unexpected users or IPs.
• Watch for outbound connections or file writes from the Nagios XI host that deviate from baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.