CVE-2025-34227: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Nagios Nagios XI
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.
AI Analysis
Technical Summary
CVE-2025-34227 is an authenticated OS command injection vulnerability affecting Nagios XI versions before 2026R1. The vulnerability exists in the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards, where shell characters can be injected into arguments passed to services. Successful exploitation allows execution of arbitrary system commands as the 'nagios' user on the underlying host. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
An attacker with authenticated access to Nagios XI can execute arbitrary system commands with the privileges of the 'nagios' user. This can lead to unauthorized system control, data compromise, or disruption of monitoring services. The high CVSS score reflects significant potential impact on system confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Users should monitor the Nagios vendor advisories for updates and apply the official fix once released. Until then, restrict authenticated access to trusted users only and consider additional network-level controls to limit exposure.
CVE-2025-34227: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Nagios Nagios XI
Description
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.
CVSS v4.0
Score 8.6high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-34227 is an authenticated OS command injection vulnerability affecting Nagios XI versions before 2026R1. The vulnerability exists in the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards, where shell characters can be injected into arguments passed to services. Successful exploitation allows execution of arbitrary system commands as the 'nagios' user on the underlying host. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
An attacker with authenticated access to Nagios XI can execute arbitrary system commands with the privileges of the 'nagios' user. This can lead to unauthorized system control, data compromise, or disruption of monitoring services. The high CVSS score reflects significant potential impact on system confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation is currently available for this vulnerability. Users should monitor the Nagios vendor advisories for updates and apply the official fix once released. Until then, restrict authenticated access to trusted users only and consider additional network-level controls to limit exposure.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.574Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68d57805ed5018220eb18957
Added to database: 09/25/2025, 17:12:37 UTC
Last enriched: 05/21/2026, 12:09:14 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 299
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.