Cyber Posture

CVE-2025-34227

HighPublic PoCRCE

Published: 25 September 2025

Published
25 September 2025
Modified
14 October 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0234 85.0th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-34227 is a high-severity OS Command Injection (CWE-78) vulnerability in Nagios Nagios Xi. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 15.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Unix Shell (T1059.004). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly validates and sanitizes user inputs to the Nagios XI wizards to block injection of shell characters into service arguments.

prevent

Ensures timely identification, reporting, and patching of the command injection flaw in Nagios XI versions prior to 2026R1.

prevent

Enforces least privilege for the nagios user to restrict the scope and impact of arbitrary commands executed via the vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

The vulnerability is an authenticated command injection in the Nagios XI Configuration Wizard (MySQL/PostgreSQL wizards), allowing arbitrary shell commands to be executed as the nagios user via Unix shell interpreters when tainted arguments are passed to system commands.

NVD Description

Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and…

more

execute arbitrary system commands on the underlying host as the `nagios` user.

Deeper analysisAI

CVE-2025-34227 is an authenticated command injection vulnerability (CWE-78) affecting Nagios XI versions prior to 2026R1. The issue exists within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards, where shell characters can be injected into arguments provided to these services. This enables execution of arbitrary system commands on the underlying host as the `nagios` user. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-09-25.

An authenticated attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Exploitation allows the attacker to execute arbitrary commands as the `nagios` user, potentially leading to high-impact effects on confidentiality, integrity, and availability of the affected system.

Advisories point to upgrading to Nagios XI 2026R1 as the primary mitigation. Relevant resources include technical details at https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/, the Nagios changelog at https://www.nagios.com/changelog/, the security products page at https://www.nagios.com/products/security/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/nagios-xi-config-wizard-auth-command-injection.

Details

CWE(s)

Affected Products

nagios
nagios xi
≤ 2026

CVEs Like This One

CVE-2025-34284Same product: Nagios Nagios Xi
CVE-2024-14003Same product: Nagios Nagios Xi
CVE-2026-2043Same product: Nagios Nagios Xi
CVE-2026-2041Same product: Nagios Nagios Xi
CVE-2024-14005Same product: Nagios Nagios Xi
CVE-2026-2042Same product: Nagios Nagios Xi
CVE-2020-36856Same product: Nagios Nagios Xi
CVE-2020-36867Same product: Nagios Nagios Xi
CVE-2013-10073Same product: Nagios Nagios Xi
CVE-2018-25122Same product: Nagios Nagios Xi

References