VULNERABILITY INTELLIGENCE

CVE-2018-25122

CVSS score8.8 HIGH
EPSS probability1.68%
CISA KEVNot currently listed
Published2025-10-30
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to inject commands or otherwise execute arbitrary code with the privileges of the application service.

Weakness classification

  • disclosure@vulncheck.com: CWE-78

Primary references