CVE-2024-14004CWE-269privilege-escalation

CVE-2024-14004

High · published October 31, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
65.6
In the wild
Unconfirmed
What it is

⚡ An authenticated user can twist NagVis settings like a mischievous magician pulling a fast one on your system! 🎩✨ Think of it like a restaurant where a waiter can rewrite the menu to include their favorite dishes — suddenly, they’re in charge of what everyone gets to eat, and that can create a whole lot of chaos! If exploited, this privilege escalation could allow an attacker to gain full control over the Nagios XI system, manipulating critical monitoring settings or worse, compromising the entire infrastructure. It’s the digital equivalent of letting a rogue chef run the kitchen, potentially leading to disastrous outcomes!

Put simply

Think of it like a restaurant where a waiter can rewrite the menu to include their favorite dishes — suddenly, they’re in charge of what everyone gets to eat, and that can create a whole lot of chaos! This vulnerability arises from insufficient validation of NagVis configuration data, allowing an authenticated user to modify settings in nagvis.conf to escalate their privileges.

What to do

If exploited, this privilege escalation could allow an attacker to gain full control over the Nagios XI system, manipulating critical monitoring settings or worse, compromising the entire infrastructure. It’s the digital equivalent of letting a rogue chef run the kitchen, potentially leading to disastrous outcomes! Upgrade to Nagios XI version 2024R1.2 or later immediately to close this gap. Additionally, review and enforce strict access controls to minimize exposure from potentially malicious users. You’ve got this! With these steps, you’ll be back in control in no time. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01109 · 65.6th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-10-31T02:15Z
Affected products (10)
ProductVersionsFixed in
nagios/nagios_xi< 20242024
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
References (3)
EPSS history
Timeline
  • 30 OCT 21:40Z
    Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)
    cvelistv5