Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl
Priority LOW 36CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-data. Because the file was writable by www-data, an attacker with web server privileges could modify its contents, leading to arbitrary code execution as the nagios user when the script is next run. This improper ownership and permission configuration enables local privilege escalation.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix Fixed XI (Nagios): 2024R2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Nagios | XI | before 2024R2 | 2024R2 | Patch available | CNA |
- XI VendorNagios Affected before 2024R2 Fixed in 2024R2 Patch available CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:* | before 2024 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:* | 2024 r1 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:* | 2024 r1.0.1 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.0.2:*:*:*:*:*:* | 2024 r1.0.2 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.1:*:*:*:*:*:* | 2024 r1.1 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.1.1:*:*:*:*:*:* | 2024 r1.1.1 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.1.2:*:*:*:*:*:* | 2024 r1.1.2 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.1.3:*:*:*:*:*:* | 2024 r1.1.3 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.1.4:*:*:*:*:*:* | 2024 r1.1.4 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.1.5:*:*:*:*:*:* | 2024 r1.1.5 | Vulnerable | Nagios |
- cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:* Versions before 2024 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:* Versions 2024 r1 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:* Versions 2024 r1.0.1 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.0.2:*:*:*:*:*:* Versions 2024 r1.0.2 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1:*:*:*:*:*:* Versions 2024 r1.1 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.1:*:*:*:*:*:* Versions 2024 r1.1.1 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.2:*:*:*:*:*:* Versions 2024 r1.1.2 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.3:*:*:*:*:*:* Versions 2024 r1.1.3 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.4:*:*:*:*:*:* Versions 2024 r1.1.4 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.1.5:*:*:*:*:*:* Versions 2024 r1.1.5 Vulnerable ·Nagios
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nagios:nagios_xi:2024:r1.2:*:*:*:*:*:* | 2024 r1.2 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.2.1:*:*:*:*:*:* | 2024 r1.2.1 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.2.2:*:*:*:*:*:* | 2024 r1.2.2 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.3:*:*:*:*:*:* | 2024 r1.3 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.3.1:*:*:*:*:*:* | 2024 r1.3.1 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.3.2:*:*:*:*:*:* | 2024 r1.3.2 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.3.3:*:*:*:*:*:* | 2024 r1.3.3 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.3.4:*:*:*:*:*:* | 2024 r1.3.4 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.4:*:*:*:*:*:* | 2024 r1.4 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.4.1:*:*:*:*:*:* | 2024 r1.4.1 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.4.2:*:*:*:*:*:* | 2024 r1.4.2 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.4.3:*:*:*:*:*:* | 2024 r1.4.3 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:nagios_xi:2024:r1.4.4:*:*:*:*:*:* | 2024 r1.4.4 | Vulnerable | Nagios |
- cpe:2.3:a:nagios:nagios_xi:2024:r1.2:*:*:*:*:*:* Versions 2024 r1.2 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.2.1:*:*:*:*:*:* Versions 2024 r1.2.1 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.2.2:*:*:*:*:*:* Versions 2024 r1.2.2 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.3:*:*:*:*:*:* Versions 2024 r1.3 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.3.1:*:*:*:*:*:* Versions 2024 r1.3.1 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.3.2:*:*:*:*:*:* Versions 2024 r1.3.2 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.3.3:*:*:*:*:*:* Versions 2024 r1.3.3 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.3.4:*:*:*:*:*:* Versions 2024 r1.3.4 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.4:*:*:*:*:*:* Versions 2024 r1.4 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.4.1:*:*:*:*:*:* Versions 2024 r1.4.1 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.4.2:*:*:*:*:*:* Versions 2024 r1.4.2 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.4.3:*:*:*:*:*:* Versions 2024 r1.4.3 Vulnerable ·Nagios
- cpe:2.3:a:nagios:nagios_xi:2024:r1.4.4:*:*:*:*:*:* Versions 2024 r1.4.4 Vulnerable ·Nagios
Remediation
- Fix · CNA XI (Nagios) Fixed in 2024R2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Nagios XI 2024R2
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-24422 Nagios XI < 2024R2 Authenticated Command Injection via WinRM PluginPriority MEDIUM 55
Timeline
- 2026-10-02 Threatist record created from CVE-2025-34287
- 2026-10-03 Alias added: GHSA-gvrp-ffhh-698m
References
More Nagios Xi vulnerabilities
- TI-2021-07545 Nagios XI version xi-5.7.5 is affected by OS command injection. KEVCVSS 3.1HIGH 8.8
- TI-2021-07544 Nagios XI version xi-5.7.5 is affected by OS command injection. KEVCVSS 3.1HIGH 8.8
- TI-2021-07543 Nagios XI version xi-5.7.5 is affected by OS command injection. KEVCVSS 3.1HIGH 8.8
- TI-2019-11993 Nagios XI before 5.6.6 allows remote command execution as root. KEVCVSS 3.1HIGH 8.8
- TI-2023-26027 Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE)… CVSS 3.1CRITICAL 9.8
- TI-2018-11196 Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2025-34287 · CVE Program
- CVE-2025-34287 · NVD
- FIRST EPSS
- GHSA-gvrp-ffhh-698m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences