CVE-2025-34227CWE-78command-injection

CVE-2025-34227

High · published September 25, 2025

CVSS v3.1

8.8

EPSS

25%

Percentile

97.9

In the wild

Unconfirmed

What it is

Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.25351 · 97.9th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2025-09-25T21:15Z

Affected products (1)

Product	Versions	Fixed in
nagios/nagios_xi	≤ 2026	—

References (4)

https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/ · [email protected]https://www.nagios.com/changelog/ · [email protected]https://www.nagios.com/products/security/ · [email protected]https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection · [email protected]

EPSS history

Timeline

25 SEP 17:08Z
Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection
cvelistv5