CVE-2024-14005

published 2025-10-30

CVE-2024-14005: Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the…

Priority P2 65 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the wizard allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
nagios	nagios_xi	< 2024	2024
nagios	nagios_xi	—	—
nagios	nagios_xi	—	—
nagios	nagios_xi	—	—
nagios	nagios_xi	—	—
nagios	nagios_xi	—	—
nagios	nagios_xi	—	—
nagios	nagios_xi	—	—
nagios	nagios_xi	—	—
nagios	nagios_xi	—	—
nagios	xi	< 2024R1.2	2024R1.2

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78