External risk intelligence

Nagios XI Business Process Intelligence Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2025-34134

Nagios XI is often deployed in enterprise environments with web interfaces sometimes exposed to the internet for remote access. While this vulnerability requires administrative authentication, which restricts broad exploitation, the ability to reach the management interface from the network allows for potential remote exploitation if the instance is publicly accessible.

OS Command Injection

Nagios Xi

before 20242024

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A remote code execution vulnerability has been identified in the Business Process Intelligence component of Nagios XI. This issue arises from insufficient validation of administrator-controlled parameters, allowing an authenticated administrative user to potentially create or overwrite files within the webroot. If these files have executable extensions, arbitrary code could be executed with the privileges of the Nagios XI web application user, potentially leading to further control of the host operating system.

Allows attackers to run unauthorized commands.
Matters if administrative access is compromised.
Confirm relevance and exposure of Nagios XI.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access could exploit this vulnerability by manipulating configuration settings within the Business Process Intelligence component. By controlling specific configuration parameters, an attacker can cause the application to create or overwrite files in the webroot. These files can then be modified to contain executable code and served by the web application, leading to arbitrary code execution with the privileges of the Nagios XI web application user.

Requires authenticated administrative access.
Manipulates BPI configuration to write executable files.
Arbitrary code execution in web application context.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated administrator to execute arbitrary commands on the Nagios XI server. This could occur by manipulating configuration parameters to create or overwrite files within the webroot, which are then served by the web application, leading to code execution within the context of the web application's user. The consequences could extend to gaining further control over the host operating system.

Server operating system commands at risk.
Via crafted BPI configurations.
Arbitrary command execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Systems owners and platform teams are most likely responsible for addressing this vulnerability in Nagios XI's Business Process Intelligence component. The first step is to identify all instances of Nagios XI, determine their network exposure and business criticality, and locate the accountable owner before planning remediation.

Identify Nagios XI instances and owners.
Verify network exposure and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Nagios XI and the Business Process Intelligence component?

Nagios XI is a commercial enterprise monitoring software used to track the health and performance of IT infrastructure, such as servers, applications, and network devices. The Business Process Intelligence (BPI) component is a specialized feature within Nagios XI that allows administrators to aggregate various service statuses into high-level business process views, helping teams visualize how infrastructure issues impact specific business operations.

How does CVE-2025-34134 work as a remote code execution vulnerability?

This vulnerability is classified as Improper Neutralization of Special Elements used in an OS Command (CWE-78). It occurs because the BPI component fails to properly validate certain file path configurations. An attacker who has already gained administrative access can exploit this by changing these settings to overwrite critical files in the web directory. By replacing or creating these files with malicious scripts, the server executes the injected code when the web application processes them.

Can this vulnerability be triggered without administrative access?

No. The trigger path for this vulnerability strictly requires a user to have existing, legitimate administrative privileges within the Nagios XI application. It cannot be triggered by unauthenticated users, anonymous visitors, or users with lower-level, non-administrative accounts. The flaw relies on the ability to modify specific BPI configuration parameters, which are restricted to administrative roles.

Why should I be concerned if my Nagios XI instance is internet-facing?

According to Halo Surface Signal, instances exposed to the internet face a higher risk because they are reachable by attackers globally. While administrative authentication is required to trigger the bug, an internet-exposed management interface increases the likelihood that a compromised account—or an attacker using stolen credentials—could reach the console and execute commands to gain control over the underlying host operating system.

What should I do first to address CVE-2025-34134?

Your first step is to perform an inventory of all Nagios XI servers in your environment to identify which versions are in use. Focus on identifying systems running any version prior to 2024R1.4.2. Once you have identified these instances, prioritize them based on their network exposure and business impact, and coordinate with the system owners to apply the necessary updates provided by the vendor to close this vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.