CVE-2021-25296

Nagios XI 5.7.5 contains an OS command injection flaw in the Windows WMI configuration wizard (windowswmi.inc.php), where authenticated user-controlled input is not properly sanitized. A single crafted HTTP request from an authenticated low-privileged user is enough to execute arbitrary operating system commands on the Nagios XI server, giving attackers full compromise of confidentiality, integrity, and availability (CVSS 8.8). Organizations running Nagios XI 5.7.5, particularly internet-facing monitoring servers, are affected. The flaw is publicly documented with proof-of-concept exploits and a Metasploit module, and it was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-01-18 with a 72.2% EPSS exploitation probability. Reported campaigns have turned vulnerable Nagios XI servers into cryptocurrency miners, and multi-exploit botnet activity (e.g., Mirai variants) has also targeted this class of flaws.

What to do: Upgrade Nagios XI from 5.7.5 to the latest vendor-supplied release per Nagios' instructions, as required by the CISA KEV entry. Until patched, restrict access to the Nagios XI web interface and configuration wizards and review access logs for requests to the windowswmi wizard endpoint. Also check affected servers for unexpected processes or outbound connections that could indicate cryptomining or botnet payloads.