CVEvulnerability
CVE-2024-14004
8.7 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2025-10-30
- Last modified
- 2026-10-02
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-269
Description
Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf). An authenticated user could manipulate NagVis configuration data or leverage insufficiently validated configuration settings to obtain elevated privileges on the Nagios XI system.
Affected configurations
• nagios nagios xi (< 2024)
• nagios nagios xi 2024
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- https://www.nagios.com/changelog/nagios-xi/ Release Notes
- https://www.nagios.com/products/security/#nagios-xi Vendor Advisory
- https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-nagvis-configuration Third Party Advisory