Remote Code Execution Vulnerability in Nagios XI by Nagios
CVE-2018-25122

8.7HIGH

Key Information:

Vendor

NagiOS

Status
Xi
Vendor
CVE Published:
30 October 2025

What is CVE-2018-25122?

Nagios XI prior to version 5.4.13 contains a vulnerability that allows authenticated users to execute arbitrary commands through the Component Download page. This security issue arises from improper validation and output encoding in the download/import handler, enabling attackers to inject potentially harmful commands that run with the service's privileges.

Affected Version(s)

XI 0 < 5.4.13

References

https://www.nagios.com/changelog/nagios-xi/
release-notespatch
https://www.vulncheck.com/advisories/nagios-xi-component-...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bjoern Brixner at Telekom Security
JSON
.
CVE-2018-25122 : Remote Code Execution Vulnerability in Nagios XI by Nagios