CVE-2021-25297
Nagios XI OS Command Injection
Description
CVE-2021-25297 is a high-severity OS command injection vulnerability in Nagios XI version 5.7.5. The flaw exists in the switch configuration wizard (switch.inc.php) due to improper sanitization of authenticated user-controlled input, enabling an attacker to execute arbitrary operating system commands on the Nagios XI server through a single HTTP request. CISA has added CVE-2021-25297 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 62.65% (98.4th percentile), this Nagios XI command injection vulnerability poses a significant exploitation risk and requires prompt remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| nagios | nagios xi | >= 5.5.6, <= 5.7.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://assets.nagios.com/downloads/nagiosxi/versions.php(Product)
- https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md(Exploit, Third Party Advisory)
- https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25297(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
OS Command Injection occurs when software constructs operating system commands using externally-influenced input without properly neutralizing special shell metacharacters. In CVE-2021-25297, the Nagios XI switch configuration wizard fails to sanitize user-supplied parameters before passing them to OS command execution functions, allowing authenticated attackers to inject and execute arbitrary commands on the underlying server.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2021-25297 carries a CVSS 3.1 score of 8.8 (HIGH), representing a serious security threat to Nagios XI deployments. The vulnerability is remotely exploitable over the network with low attack complexity and requires only low-level authentication to a Nagios XI user account. No user interaction is needed for successful exploitation. Confidentiality (High): Attackers can execute commands to read sensitive files, extract credentials, and exfiltrate monitoring data from the Nagios XI server. Integrity (High): Command injection allows modification of system configurations, creation of backdoor accounts, and alteration of monitoring data to hide malicious activity. Availability (High): Malicious commands can disrupt the monitoring service, terminate critical processes, or render the server inoperable. The EPSS score of 62.65% indicates a high likelihood of active exploitation. Nagios XI servers are high-value targets because they typically have network visibility into critical infrastructure components.
Exploit Maturity
CVE-2021-25297 has multiple publicly available exploits confirming its weaponization. Public exploit code is available via Packet Storm Security and a comprehensive Fastly blog post with Metasploit module details. Additional exploit information is documented in the GitHub advisory. CISA has confirmed active exploitation by including this vulnerability in the KEV catalog with a remediation deadline of 2022-02-01. The EPSS score of 62.65% (98.4th percentile) indicates a high probability of exploitation. CVE-2021-25297 is part of a trio of related Nagios XI command injection vulnerabilities (CVE-2021-25296, CVE-2021-25297, CVE-2021-25298) affecting different configuration wizard endpoints in the same version, which attackers may chain or use interchangeably depending on available attack surface.
Remediation
- Apply updates immediately as required by CISA KEV. Upgrade Nagios XI beyond version 5.7.5 to a patched release that resolves the command injection vulnerabilities in the configuration wizard components.
- Confirm all Nagios XI installations are running versions newer than 5.7.5. Affected versions span from 5.5.6 through 5.7.5.
- Implement strict network access controls to the Nagios XI web interface using firewall rules and network segmentation. Only allow access from trusted management networks, as exploitation requires authenticated access.
- Audit all Nagios XI user accounts and enforce least-privilege principles. Remove unnecessary accounts and disable default credentials, since even low-privileged authenticated users can exploit this vulnerability through the switch configuration wizard.
- Deploy monitoring for suspicious activity on the Nagios XI server, including unexpected process creation, anomalous HTTP requests to configuration wizard endpoints (particularly switch.inc.php), and unauthorized file modifications. Implement host-based intrusion detection on the Nagios XI server.
Technical Details
CVE-2021-25297 is an OS command injection vulnerability located in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php within Nagios XI version 5.7.5. The vulnerability stems from the switch configuration wizard accepting user-controlled input via HTTP parameters and incorporating it into operating system commands without proper sanitization. An authenticated attacker can exploit this by including shell metacharacters such as semicolons, pipes, backticks, or command substitution syntax in the input, causing the server to execute arbitrary commands alongside the intended operation. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-based exploitation with low complexity, low privilege requirements, and maximum impact across all three security pillars. The root cause is CWE-78 (OS Command Injection), where the application directly passes user input to shell execution functions rather than using parameterized command execution interfaces or implementing strict input validation against an allowlist of safe characters.
Frequently Asked Questions
Is CVE-2021-25297 being actively exploited?
Yes. CVE-2021-25297 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. Multiple public exploits exist including proof-of-concept code on Packet Storm Security and a Metasploit module. The EPSS score of 62.65% further confirms a high probability of exploitation.
What products are affected by CVE-2021-25297?
CVE-2021-25297 affects Nagios XI versions 5.5.6 through 5.7.5. The vulnerability resides in the switch configuration wizard component (switch.inc.php). It is one of three related command injection vulnerabilities (CVE-2021-25296, CVE-2021-25297, CVE-2021-25298) affecting Nagios XI 5.7.5 through different configuration wizard files.
How do I fix CVE-2021-25297?
Upgrade Nagios XI to a version newer than 5.7.5. Until patching is complete, restrict network access to the Nagios XI web interface, audit and minimize user accounts, and monitor for anomalous command execution on the server.
How severe is CVE-2021-25297?
CVE-2021-25297 has a CVSS 3.1 score of 8.8 (HIGH). It enables authenticated remote attackers to execute arbitrary OS commands on the Nagios XI server with no user interaction required. The EPSS score of 62.65% (98.4th percentile) indicates a high probability of exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.