CVE-2021-25297

KEV High · CVSS 8.8

Nagios XI — OS Command Injection (CWE-78)

CVSS: 8.8; nvd
EPSS: 58.7%; 99th pct
KEV: Listed; 2022-01-18
Class: other; NVD-CWE-Other, CWE-78

Description

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Search profile — drives PoC discovery

Symbols switch.inc.php/usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.phpconfigwizardsCVE-2021-25297CVE-2021-25296CVE-2021-25298

Keywords Nagios XI 5.7.5 OS command injectionCVE-2021-25297 PoCNagios XI switch.inc.php exploitNagios XI configwizards RCENagios XI 5.7.5 remote code executionnagios-xi-5.7.5-bugsCVE-2021-25296 CVE-2021-25297 CVE-2021-25298 Metasploit

Versions: xi-5.7.5

Ranked PoCs (2) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

fs0c-sh/nagios-xi-5.7.5-bugs needs review

cited in references

trickest

★ 0
k0pak4/k0pak4 needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T06:30:39.000Z