{"id":"CVE-2021-25296","aliases":["EUVD-2021-12196","GHSA-8hgr-54hv-7pgc"],"status":"published","title":"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the...","description":"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.71935,"percentile":0.99432,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-138","CWE-78"],"published":"2021-02-15T00:00:00Z","modified":"2026-07-09T13:39:49Z","kev":{"date_added":"2022-01-18","due_date":"2022-02-01","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-01-18"},{"source":"kev","since":"2022-01-18"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/nagios_xi_configwizards_authenticated_rce","title":"Nagios XI 5.5.6 to 5.7.5 - ConfigWizards Authenticated Remote Code Exection","type":"exploit","platform":"Linux,Unix","date":"2021-02-13","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/nagios_xi_configwizards_authenticated_rce"},{"source":"nuclei","id":"CVE-2021-25296","title":"Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25296.yaml"}],"products":[{"vendor":"nagios","product":"nagios xi"},{"vendor":"nagios","product":"nagios_xi"}],"references":[{"url":"https://assets.nagios.com/downloads/nagiosxi/versions.php","tags":["x_transferred","Product"]},{"url":"https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html","tags":["x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25296","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25296"},{"url":"http://nagios.com"},{"url":"https://github.com/advisories/GHSA-8hgr-54hv-7pgc"}],"sources":{"cve":[{"id":"CVE-2021-25296","description":"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.","status":"published","published":"2021-02-15T00:00:00Z","modified":"2026-07-09T00:12:24.42Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:32:59.802172Z"}],"euvd":[{"id":"EUVD-2021-12196","description":"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.","status":"published","published":"2021-02-15T00:00:00Z","modified":"2026-07-09T00:12:24Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-01-18","updated_at":"2026-11-02T18:20:09.112703Z"}],"ghsa":[{"id":"GHSA-8hgr-54hv-7pgc","title":"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the...","description":"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.","status":"published","published":"2022-05-24T17:42:15Z","modified":"2025-10-22T00:32:03Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:04.786232Z"}],"kev":[{"id":"CVE-2021-25296","title":"Nagios XI OS Command Injection","description":"Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.","cwes":["CWE-78","CWE-138"],"kev":{"date_added":"2022-01-18","due_date":"2022-02-01","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2021-25296","description":"Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.","status":"published","published":"2021-02-15T13:15:12.683Z","modified":"2026-07-09T13:39:49.13Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:50.031227Z"}]}}