CVE-2024-13997CWE-269privilege-escalation

CVE-2024-13997

High · published November 4, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
68.2
In the wild
Unconfirmed
What it is

🚨 Strap in, because an authenticated admin can turn a harmless migration feature into a ticket to root access! 🔥 Think of it like a hotel manager discovering a secret passage that leads to the vault — they can bypass all security measures and access everything they want, all thanks to a sneaky oversight in the building's design! The consequences of this vulnerability are absolutely devastating. An attacker with admin access could not only manipulate Nagios XI but also gain total control of the underlying operating system. This means they could steal sensitive data, modify settings, and wreak havoc throughout the entire infrastructure!

Put simply

Think of it like a hotel manager discovering a secret passage that leads to the vault — they can bypass all security measures and access everything they want, all thanks to a sneaky oversight in the building's design! CVE-2024-13997 is a privilege escalation vulnerability where an authenticated administrator can misuse the Migrate Server feature to execute commands with root privileges on the host system, effectively bypassing security controls.

What to do

The consequences of this vulnerability are absolutely devastating. An attacker with admin access could not only manipulate Nagios XI but also gain total control of the underlying operating system. This means they could steal sensitive data, modify settings, and wreak havoc throughout the entire infrastructure! To protect your system, immediately upgrade Nagios XI to version 2024R1.1.3 or later. Review your user permissions to ensure that only trusted individuals have admin access, and monitor admin activities closely for any suspicious behavior. You've got this! Follow these steps to secure your environment and restore peace of mind. 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01210 · 68.2th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-11-04T03:16Z
Affected products (7)
ProductVersionsFixed in
nagios/nagios_xi< 20242024
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
References (3)
EPSS history
Timeline
  • 03 NOV 21:55Z
    Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host
    cvelistv5