CVE-2021-25296

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 71,9%

Kerentanan pada nagios xi. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 18 Januari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Rincian

Terbit di NVD

15 Februari 2021

Terakhir diubah

9 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

71,9% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Nagios XI OS Command Injection

Masuk KEV

18 Januari 2022

Tenggat CISA

1 Februari 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25296 pemerintah AS
• http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html advisory pihak ketiga · vdb entry
• https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md exploit · advisory pihak ketiga
• https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and exploit · advisory pihak ketiga
• https://assets.nagios.com/downloads/nagiosxi/versions.php product