CVE-2021-25296

KEV High · CVSS 8.8

Nagios XI — OS Command Injection

CVSS: 8.8; nvd
EPSS: 71.5%; 99th pct
KEV: Listed; 2022-01-18
Class: other; NVD-CWE-Other

Description

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Search profile — drives PoC discovery

Symbols windowswmi.inc.php/usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.phpconfigwizardswindowswmi

Keywords CVE-2021-25296Nagios XI 5.7.5OS command injectionwindowswmiconfigwizardsNagios XI RCEnagios-xi-5.7.5-bugsMetasploit module CVE-2021-25296

Versions: xi-5.7.5

Ranked PoCs (5) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

EdgeSecurityTeam/Vulnerability candidate

known researcher

trickest

★ 0
r0eXpeR/redteam_vul candidate

known researcher

trickest

★ 0
fs0c-sh/nagios-xi-5.7.5-bugs needs review

cited in references

trickest

★ 0
k0pak4/k0pak4 needs review

trickest

★ 0
tzwlhack/Vulnerability needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T06:30:39.000Z