Cyber Posture

CVE-2018-25122

HighPublic PoC

Published: 30 October 2025

Published
30 October 2025
Modified
05 November 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0138 80.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2018-25122 is a remote code execution vulnerability affecting Nagios XI versions prior to 5.4.13, specifically in the Component Download page. The issue stems from unsafe command construction in the download/import handler, which processes attacker-controlled input without sufficient validation or output encoding. This flaw, classified under CWE-78 (OS Command Injection), enables command injection and arbitrary code execution with the privileges of the Nagios XI application service. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise.

An authenticated user with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By crafting malicious input during component download or import operations, the attacker can inject operating system commands, leading to arbitrary code execution on the server hosting Nagios XI. Successful exploitation grants the attacker the same privileges as the application service, potentially allowing full control over the monitoring system and any connected infrastructure.

Mitigation involves upgrading to Nagios XI version 5.4.13 or later, as detailed in the official Nagios changelog at https://www.nagios.com/changelog/nagios-xi/. Additional guidance on the vulnerability and remediation is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/nagios-xi-component-download-page-rce.

Details

CWE(s)
CWE-78

Affected Products

nagios
nagios xi
≤ 5.4.13

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

RCE via OS command injection (T1059.004) in a network-accessible web application (T1190), enabling privilege escalation from low-privilege authenticated access (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References