CVE-2021-25298: Nagios XI cloud-vm config wizard OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with public exploit code, a very high EPSS score, and yields remote OS command execution on a monitoring server, though it requires authenticated access.

What it is

Nagios XI 5.7.5 fails to properly sanitize authenticated user input in /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php, allowing OS command injection through a single HTTP request. Because the affected component is a configuration wizard on the monitoring server, successful exploitation gives command execution on a host that typically holds broad infrastructure access.

Impact

An attacker gains arbitrary OS command execution on the Nagios XI server, with high impact to confidentiality, integrity and availability per the CVSS vector. This can lead to full compromise of the monitoring host and any credentials or managed systems it reaches.

Attack surface

Reachable over the network via HTTP against the cloud-vm configuration wizard; the CVSS vector (AV:N/PR:L/UI:N) indicates a low-privileged authenticated user is required and no user interaction is needed.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-01-18, and EPSS gives a 30-day probability of 0.75148 (99.5th percentile); multiple references are tagged Exploit, including public Metasploit-related write-ups. No ransomware campaign use is documented.

What to do

• Upgrade Nagios XI to a version later than 5.7.5 per vendor instructions, which is the required KEV action.
• Restrict access to the Nagios XI web interface to trusted administrative networks and accounts.
• Audit and minimize accounts with access to configuration wizards, removing unused or over-privileged users.
• Monitor the Nagios XI host for unexpected child processes spawned by the web server.
• If immediate patching is not possible, isolate or tightly firewall the Nagios XI server.

Detection

• Alert on web server or PHP processes spawning shells or system utilities (e.g., sh, bash, curl, wget) on the Nagios XI host.
• Review HTTP requests to /nagiosxi/includes/configwizards/cloud-vm/ for shell metacharacters or command-like parameters.
• Correlate Nagios XI authentication logs with subsequent process creation events on the same host.
• Hunt for outbound connections from the Nagios XI server to unfamiliar hosts following wizard activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.