CVE-2021-25297

CVE-2021-25297 is an OS command injection flaw (CWE-78) in Nagios XI version 5.7.5, located in the switch configuration wizard at /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php. It is triggered when user-controlled input sent in a single HTTP request is not properly sanitized before being passed to the underlying operating system, so any authenticated user who can reach the wizard can inject shell commands. Successful exploitation yields arbitrary command execution on the Nagios XI server with the privileges of the web application, enabling full compromise of the monitoring server and its credentials or network access. Organizations running Nagios XI 5.7.5, particularly those with the web interface reachable by authenticated users or exposed to the internet, are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-01-18) with a 56.7% EPSS probability of exploitation within 30 days, plus multiple public PoCs and a Metasploit module, indicating active exploitation in the wild.

What to do: Update Nagios XI per vendor instructions to a release newer than 5.7.5 that fixes the switch config wizard injection, and prioritize patching any internet-facing instances given its CISA KEV listing. If patching is delayed, restrict authenticated access to the configuration wizards and the Nagios XI web interface at the network layer, and review server logs for unexpected command execution or connections to the switch wizard. With exploitation likely ongoing, treat any unpatched 5.7.5 systems as potentially compromised and check for post-exploitation activity.