VDB
CVE-2025-34284
CVE-2025-34284
PUBLISHED
CVSS 9.399999618530273 CRITICAL
Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to modify configuration, exfiltrate data, disrupt monitoring operations, or execute commands on the underlying host operating system.
EPSS 0.83% · 75.0th percentile
Risk Scores
CVSS 4.0
9.399999618530273
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS Score
0.83%
75.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| nagios | nagios_xi | 2024, 0, 0 |
| Nagios | XI | 0 |
Timeline
- Oct 30, 2025 CVE Published
- Oct 31, 2025 EPSS Score
- Oct 31, 2025 PoC Published
- Oct 31, 2025 PoC Published
- Nov 6, 2025 EPSS Score
- Nov 11, 2025 EPSS Score
- Nov 17, 2025 EPSS Score
- Nov 17, 2025 CVE Updated
- Nov 22, 2025 EPSS Score
- Nov 28, 2025 EPSS Score
- Dec 3, 2025 EPSS Score
- Dec 9, 2025 EPSS Score
References
- https://www.nagios.com/products/security/#nagios-xi vendor-advisory
- https://www.nagios.com/changelog/nagios-xi/ patch
- https://www.vulncheck.com/advisories/nagios-xi-authenticated-command-injection-via-winrm-plugin third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-34284 advisory
- https://www.nagios.com/changelog/nagios-xi url