CVE-2021-25296
Nagios XI OS Command Injection
Description
CVE-2021-25296 is a high-severity OS command injection vulnerability in Nagios XI version 5.7.5. The vulnerability exists in the Windows WMI configuration wizard (windowswmi.inc.php) due to improper sanitization of authenticated user-controlled input, allowing an attacker to inject and execute arbitrary operating system commands on the Nagios XI server via a single HTTP request. CISA has added CVE-2021-25296 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 93.56% (99.8th percentile), this Nagios XI command injection vulnerability has a near-certain probability of exploitation and demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| nagios | nagios xi | >= 5.5.6, <= 5.7.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- https://assets.nagios.com/downloads/nagiosxi/versions.php(Product)
- https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md(Exploit, Third Party Advisory)
- https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25296(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
OS Command Injection occurs when software constructs operating system commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2021-25296, the Nagios XI windowswmi configuration wizard fails to sanitize user-supplied input before incorporating it into OS commands, allowing authenticated attackers to inject shell metacharacters and execute arbitrary commands with the privileges of the Nagios XI application.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2021-25296 carries a CVSS 3.1 score of 8.8 (HIGH), reflecting a serious threat to Nagios XI monitoring infrastructure. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires low-level authentication (a valid Nagios XI user account). No user interaction is needed for exploitation. Confidentiality (High): Successful command injection enables attackers to read any file accessible to the Nagios application, exfiltrate monitoring data, credentials, and configuration files. Integrity (High): Attackers can modify system configurations, plant backdoors, alter monitoring data, and install persistent access mechanisms. Availability (High): Injected commands can terminate processes, disrupt monitoring services, and render the Nagios XI server inoperable. The EPSS score of 93.56% places this vulnerability in the 99.8th percentile, indicating near-certain exploitation. As Nagios XI often monitors critical infrastructure, compromise of the monitoring server can provide attackers with a comprehensive map of the organization’s network.
Exploit Maturity
CVE-2021-25296 has a mature exploit landscape with multiple publicly available exploit resources. Public exploit code is available via Packet Storm Security and a detailed technical analysis with Metasploit module published by Fastly. Additional exploit details are documented in the GitHub advisory. CISA has confirmed active exploitation by adding this vulnerability to the KEV catalog with a remediation deadline of 2022-02-01. The EPSS score of 93.56% (99.8th percentile) indicates near-certain exploitation activity. Note that CVE-2021-25296 is part of a cluster of three related Nagios XI command injection vulnerabilities (CVE-2021-25296, CVE-2021-25297, CVE-2021-25298), all affecting version 5.7.5 through different configuration wizard endpoints.
Remediation
- Apply updates immediately as required by CISA KEV. Upgrade Nagios XI beyond version 5.7.5 to a patched release that addresses the command injection vulnerabilities in the configuration wizard components.
- Verify all Nagios XI installations are running versions newer than 5.7.5. Affected versions range from 5.5.6 through 5.7.5.
- Restrict access to the Nagios XI web interface using network segmentation and firewall rules. Limit access to trusted management networks only, as the vulnerability requires authenticated access.
- Review user accounts on the Nagios XI server and remove or disable unnecessary accounts. Implement the principle of least privilege for all Nagios XI users, as even low-privileged authenticated users can exploit this vulnerability.
- Monitor Nagios XI server logs for suspicious command execution patterns, unexpected process spawning, and anomalous HTTP requests to configuration wizard endpoints (particularly windowswmi.inc.php). Implement file integrity monitoring on the Nagios XI installation directory.
Technical Details
CVE-2021-25296 is an OS command injection vulnerability in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php within Nagios XI version 5.7.5. The vulnerability arises because authenticated user-controlled input passed through the Windows WMI configuration wizard is not properly sanitized before being incorporated into operating system commands executed on the server. An attacker with valid Nagios XI credentials can craft a single HTTP request containing shell metacharacters (such as semicolons, pipes, or command substitution syntax) that escape the intended command context and execute arbitrary OS commands. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms network-based exploitation with low complexity and low privilege requirements, resulting in complete compromise of confidentiality, integrity, and availability. The underlying weakness is CWE-78 (OS Command Injection), where the application fails to use parameterized execution interfaces or properly escape shell metacharacters in user input before passing it to system command execution functions.
Frequently Asked Questions
Is CVE-2021-25296 being actively exploited?
Yes. CVE-2021-25296 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Multiple public exploits are available including a Metasploit module, and the EPSS score of 93.56% indicates near-certain exploitation activity.
What products are affected by CVE-2021-25296?
CVE-2021-25296 affects Nagios XI versions 5.5.6 through 5.7.5. The vulnerability specifically resides in the Windows WMI configuration wizard component (windowswmi.inc.php). It is one of three related command injection vulnerabilities (CVE-2021-25296, CVE-2021-25297, CVE-2021-25298) affecting the same Nagios XI version.
How do I fix CVE-2021-25296?
Upgrade Nagios XI to a version newer than 5.7.5 that includes patches for the command injection vulnerabilities. In the interim, restrict network access to the Nagios XI web interface, minimize user accounts, and monitor for suspicious command execution on the server.
How severe is CVE-2021-25296?
CVE-2021-25296 has a CVSS 3.1 score of 8.8 (HIGH). It allows authenticated remote attackers to execute arbitrary OS commands on the Nagios XI server. The EPSS score of 93.56% places it in the 99.8th percentile for exploitation probability, and public exploit code including a Metasploit module is readily available.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.