Command Injection Vulnerability in Nagios XI by Nagios

CVE-2025-34284

What is CVE-2025-34284?

Nagios XI versions prior to 2024R2 are susceptible to a command injection vulnerability through the WinRM plugin. This flaw arises from inadequate validation of user-supplied parameters, which allows authenticated administrators to introduce shell metacharacters into backend command calls. If exploited, this vulnerability could lead to arbitrary command execution with the web application user’s privileges, enabling attackers to alter configurations, exfiltrate sensitive data, disrupt monitoring processes, or execute unauthorized commands on the host system.

References