CVE-2024-14008 CRITICAL

CVE-2024-14008: Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard

Weakness CWE-78
Published October 30, 2025
Last update November 17, 2025
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user.

Key dates

02Disclosure timeline

October 30, 2025 CVE published
November 17, 2025 Record updated