CVE-2024-14003 CRITICAL

CVE-2024-14003: Nagios XI < 2024R1.2 RCE via NRDP Server Plugins

Weakness CWE-78
Published October 30, 2025
Last update November 17, 2025
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the underlying host in the context of the web/Nagios service.

Key dates

02Disclosure timeline

October 30, 2025 CVE published
November 17, 2025 Record updated