CVE-2024-24401: Nagios XI monitoringwizard.php SQL injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required and a high EPSS score make this a top remediation priority despite no KEV listing.

What it is

Nagios XI 2024R1.01 contains a SQL injection flaw in the monitoringwizard.php component. A remote attacker can send a crafted payload that leads to arbitrary code execution on the affected server. Because the flaw is network reachable and needs no credentials, it is a serious risk to exposed Nagios XI installations.

Impact

An attacker can execute arbitrary code on the Nagios XI host, gaining control of the monitoring server and potentially pivoting to systems it manages.

Attack surface

Reached over the network through the monitoringwizard.php component; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is high at roughly 0.46 (98.7th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Nagios XI to a version later than 2024R1.01 per the vendor changelog.
• Restrict network access to the Nagios XI web interface to trusted management networks.
• Enforce authentication and least privilege on the Nagios XI application and its database account.
• Monitor the vendor changelog and advisories for the fixed release and apply it promptly.

Detection

• Review web server and Nagios XI logs for suspicious requests to monitoringwizard.php, especially SQL metacharacters or encoded payloads.
• Alert on unexpected child processes or command execution spawned by the Nagios XI web or database service.
• Baseline and monitor database queries from the Nagios XI application for anomalous SQL patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.