CVE-2021-25296highunder attack

CVE-2021-25296

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 72%
from disclosure to weapon0 days
Published on NVDFeb 15
metasploitFeb 13
CISA KEV+337d
exploitation probability
72%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2022-02-01

Apply updates per vendor instructions.

In short

Nagios XI version 5.7.5 allows authenticated users to inject operating system commands through unsanitized input in the Windows WMI configuration wizard, potentially taking over the server.

Technical detail

OS command injection vulnerability in /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php affecting Nagios XI 5.7.5. Attack requires authentication; attacker can execute arbitrary OS commands via malformed HTTP request with unsanitized parameters in the Windows WMI wizard, achieving remote code execution on the server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.htmlhttps://assets.nagios.com/downloads/nagiosxi/versions.phphttps://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.mdhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25296https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and