CVE-2024-14008CWE-78command-injection

CVE-2024-14008

High · published October 31, 2025

CVSS v3.1
7.2
EPSS
2%
Percentile
83.9
In the wild
Unconfirmed
What it is

🔥 An authenticated administrator can unwittingly unleash chaos! A small oversight in Nagios XI allows anyone with access to the WinRM Configuration Wizard to execute arbitrary commands with full privileges. 😱 Think of it as a restaurant where the chef trusts that patrons won't mess with the recipe. If a customer sneaks in a dangerous ingredient without scrutiny, the meal served can be hazardous to everyone! This vulnerability could allow an attacker to execute arbitrary commands, putting your entire Nagios XI system at risk. Imagine the devastation—malicious software, data breaches, or even a complete system takeover. This isn't just a minor issue; it's a critical warning that demands immediate action!

Put simply

Think of it as a restaurant where the chef trusts that patrons won't mess with the recipe. If a customer sneaks in a dangerous ingredient without scrutiny, the meal served can be hazardous to everyone! The vulnerability occurs due to insufficient validation of user-supplied input in the WinRM Configuration Wizard of Nagios XI. This enables an authenticated administrator to inject shell metacharacters into backend command invocations, leading to remote command execution.

What to do

This vulnerability could allow an attacker to execute arbitrary commands, putting your entire Nagios XI system at risk. Imagine the devastation—malicious software, data breaches, or even a complete system takeover. This isn't just a minor issue; it's a critical warning that demands immediate action! To protect your system, upgrade Nagios XI to version 2024R1.3.2 or later immediately. Additionally, review your user privileges and ensure that only trusted administrators have access to sensitive areas like the WinRM Configuration Wizard. Regularly audit all configurations to catch any potential misconfigurations! You've got this! By taking these steps, you're not just fixing a vulnerability; you're securing your castle! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02405 · 83.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-31T02:15Z
Affected products (15)
ProductVersionsFixed in
nagios/nagios_xi< 20242024
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
References (3)
EPSS history
Timeline
  • 30 OCT 21:43Z
    Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard
    cvelistv5