CVE-2021-25297

This flaw lets an attacker who has a (low) level of access to your Nagios XI account send a “crafted” web request that tricks the Nagios XI server into running operating system commands.

Think of it like finding a loose screw in your office door’s lock: once someone can open the door, they may be able to reach systems inside the building—not just use the software.

This matters if you run Nagios XI and attackers could get to it with an authenticated session (the reported requirement is low authentication, and no user click is needed beyond sending the malicious web request).

The vulnerable behavior is triggered by HTTP requests to the “switch” configuration wizard code path (the file under /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php).

It’s a risk when an attacker is able to log in and reach that HTTP endpoint in your deployment (reachability and exposure depend on your network access controls and configuration).

RED. This vulnerability is confirmed in the CISA Known Exploited Vulnerabilities catalog, which means real attackers have been using it—not just theoretical risk.

Because an attacker only needs a low-authenticated session to send a malicious HTTP request, you should treat this as an active, high-priority patching event.

Confirm exposure

1. Identify your exact Nagios XI version and verify whether it is xi-5.7.5 (explicitly listed as affected).
2. Identify whether your Nagios XI “switch” configuration wizard functionality is exposed to your users/network (the vulnerable code path is under /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php).
3. Review access controls: confirm who can log in to Nagios XI, and from where (admin network only vs. internet-exposed access).

Upgrade / fix

4. Follow the vendor’s remediation instructions for Nagios XI to upgrade to the latest vendor-supported release that fixes CVE-2021-25297.
5. Plan the upgrade during a maintenance window appropriate for your environment, since the fix may require changes to the running Nagios XI installation.

Temporary containment (if patching is delayed)

6. Restrict access to Nagios XI to trusted admin IPs/networks only (block external access where possible).
7. Immediately review and tighten Nagios XI user access: disable unused accounts, enforce strong passwords, and ensure only necessary users have access.

KEV timing

8. CISA KEV due date for remediation was 2022-02-01.

What to monitor after changes

9. Check Nagios XI and web server logs for suspicious requests targeting the “switch” configuration wizard path.
10. Watch for unexpected system changes or command execution indicators on the Nagios XI host after the timeframe when exploitation may have occurred.

Severity: High (CVSS 8.8 is reported).

Weakness: OS command injection (CWE-78 / command injection class).

Mechanism: An attacker can send a crafted HTTP request to the vulnerable Nagios XI “switch” configuration wizard endpoint (implementation in /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php). If the request carries unsanitized authenticated user-controlled input, it can cause the Nagios XI server process to execute arbitrary operating system commands.

Attack conditions from findings: network-deliverable and triggered via a single HTTP request; no user interaction is required; authentication is required but described as low.

Exploitation status: CISA KEV lists this vulnerability as known exploited (listed 2022-01-18). Public exploitation/weaponization is also indicated as available.

EPSS note: A prediction exists (not relied upon for public urgency). KEV confirmation governs the urgency approach.

KEV meaning here: the vulnerability is included in CISA’s catalog specifically because it has been observed being exploited in the wild, and CISA required applying vendor updates by the stated due date.