What’s Vulnerable › Vulnerabilities

CVE-2024-14003: Nagios XI < 2024R1.2 RCE via NRDP Server Plugins

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-30 · updated 2026-10-02
• Weakness: CWE-78

Description

Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the underlying host in the context of the web/Nagios service.

Affected products

• Nagios XI: before 2024; 2024-r1, 2024-r1.0.1, 2024-r1.0.2, 2024-r1.1, 2024-r1.1.1, 2024-r1.1.2 (+3) — fixed in 2024

How to fix

Upgrade to a fixed version: Nagios XI 2024. Check the vendor advisory for mitigations.

References

• https://www.nagios.com/changelog/nagios-xi/
• https://www.nagios.com/products/security/#nagios-xi
• https://www.vulncheck.com/advisories/nagios-xi-rce-via-nrdp-server-plugins

Get alerted when CVE-2024-14003 or the next vulnerability affects your stack