GCVE-110-NCSC-2025-349

Advisory Published

Vulnetix · Advisory published November 3, 2025

Nagios XI versions prior to 2024R1.4.2 are vulnerable to remote code execution in the Business Process Intelligence component due to inadequate validation of configuration parameters, allowing authenticated users to execute arbitrary code.

Download JSON Open in Console

Weaknesses (CWE)

CWE-732Incorrect Permission Assignment for Critical ResourceCWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected Products

Vendor	Product	Versions	Platforms
Nagios Enterprises	vers:unknown/*	—	—

Aliases

CVE-2025-34134 CVE-2025-34135 CVE-2025-34283 CVE-2025-34284 CVE-2025-34286 CVE-2025-34287

References

advisory

Browse GCVE Records

72,921 records in the GCVE database · Updated July 15, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON