Vulnerabilities

TI-2025-24292 CVE-2025-34134 · GHSA-7h56-968g-xcq3

Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)

MEDIUM 47

Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.02405 Published 2025-10-30 Fixed in 2024R1.4.2 CWE-78

TI-2025-24293 CVE-2025-34135 · GHSA-fv44-8gjm-pj66

LOW 23

Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive.

CVSS 4.0MEDIUM 5.1 Local No auth No interaction EPSS 0.00356 Published 2025-10-30 Fixed in 2024R1.4.2 CWE-732

TI-2025-24421 CVE-2025-34283 · GHSA-7449-5996-fmvf

LOW 39

Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0104 Published 2025-10-30 Fixed in 2024R1.4.2 CWE-497