CVE-2021-25296

🔥 Known Exploited (CISA KEV)HIGH

8.8

CVSS Severity Score

EPSS Score59.8790%

EPSS Percentile96.83th

Published2021-02-15

Last Modified2026-07-09

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Affected Platforms (CPE)

No CPE configurations currently published for this record.

References & Advisories

🔗 http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html

🔗 http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html

🔗 https://assets.nagios.com/downloads/nagiosxi/versions.php

🔗 https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md

🔗 https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and