CVE-2021-25298

What is Nagios XI's SNMP and CGI Interface?

Nagios XI's nagios.cgi and related CGI interface handle monitoring check execution, status retrieval, and configuration interactions between the Nagios XI web frontend and the Nagios Core backend. SNMP (Simple Network Management Protocol) configuration in Nagios XI allows monitoring of network devices via SNMP queries — with the wizard accepting network device addresses and community strings that are used to construct SNMP check commands. Parameters passed to the Nagios CGI interface or SNMP wizard that are incorporated into OS commands without sanitization create command injection vulnerabilities: any authenticated user who can send crafted requests to these endpoints can inject commands that execute with the elevated privileges of the Nagios process on the monitoring server.

Overview

CVE-2021-25298 is an OS command injection vulnerability in Nagios XI's SNMP monitoring configuration or nagios.cgi interface. Parameters accepted by the vulnerable endpoint are incorporated into OS commands executed on the Nagios XI server without proper sanitization, allowing an authenticated low-privilege attacker to achieve root-level code execution on the monitoring server. CVE-2021-25298 is the third in a cluster of three Nagios XI command injection vulnerabilities (25296, 25297, 25298) discovered by Rana Khalil of Cisco Talos, all patched in Nagios XI 5.7.5 (February 2021), and all added to CISA KEV in January 2022.

Affected Versions

Technical Details

• Root cause: OS command injection (CWE-78) in Nagios XI's nagios.cgi or SNMP configuration handler — a parameter controlling SNMP target addressing, community string, or check configuration is passed to an OS command without sanitization, enabling injection of arbitrary shell commands via metacharacters
• Low-privilege exploitation: PR:L — authenticated Nagios XI users regardless of role can access the affected CGI or wizard endpoint; the injection does not require administrative privileges within Nagios XI
• Root execution context: Nagios Core backend processes, including those invoked by the CGI interface, run with root or elevated OS privileges; injected commands inherit these privileges
• Monitoring infrastructure access: Post-exploitation of the Nagios XI server provides access to all SNMP community strings, device credentials, network topology data, and check scripts stored on the monitoring server — a comprehensive enumeration of the monitored network
• Three concurrent CVEs, equal severity: CVE-2021-25298 is independently exploitable and achieves the same root RCE outcome as CVE-2021-25296 and CVE-2021-25297; all three must be patched; any single unpatched wizard provides full compromise

Discovery

Discovered by Rana Khalil of Cisco Talos as part of a Nagios XI security review that identified OS command injection across multiple configuration wizard and CGI endpoints. Patched in Nagios XI 5.7.5.

Exploitation Context

See CVE-2021-25296 for the broader exploitation context of Nagios XI monitoring server vulnerabilities. The three Nagios XI command injection CVEs (25296, 25297, 25298) are treated as a unit by both defenders and attackers: a Nagios XI server running a version before 5.7.5 is vulnerable to root RCE via any of the three vectors, and patching requires upgrading to 5.7.5 to address all three simultaneously.

Remediation

1. Update Nagios XI to version 5.7.5 or later — the single update patches all three command injection CVEs (25296, 25297, 25298)
2. Restrict Nagios XI web interface network access: block access from untrusted networks and the internet; only administrator workstations should reach the Nagios XI management interface
3. Restrict which user roles can access configuration wizards and CGI endpoints within Nagios XI's access control settings
4. Rotate all credentials stored in Nagios XI (SNMP community strings, SSH keys, device passwords) after patching — these credentials should be treated as potentially compromised on any unpatched installation
5. Review the Nagios XI host for signs of compromise: unexpected user accounts, modified cron jobs, unusual processes, unauthorized SSH authorized_keys entries
6. Consider deploying Nagios XI behind a VPN or bastion host rather than directly internet-accessible