Critical severity · published Oct 30, 2025
CVE-2024-14003
Nagios XI < 2024R1.2 RCE via NRDP Server Plugins
9.8
CVSS
2.3%
EPSS
No
On KEV
Description
Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the underlying host in the context of the web/Nagios service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XI
XI · Nagios
before 2024R1.2 · source: vendor
NX
Nagios XI · Nagios
before 2024; 2024; 2024; 2024; 2024; 2024; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-14003
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-14003
vendor-advisory
https://www.nagios.com/products/security/#nagios-xi
release-notes
https://www.nagios.com/changelog/nagios-xi/
third-party-advisory
https://www.vulncheck.com/advisories/nagios-xi-rce-via-nrdp-server-plugins
More from XI
9.8
CVE-2024-13996
Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change
9.8
CVE-2012-10063
Nagios XI < 2012R1.3 Authenticated SQL Injection in Legacy CCM
9.8
CVE-2024-13994
Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization
9.8
CVE-2024-13999
Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure
8.8
CVE-2023-7317
Nagios XI < 2024R1 Web SSH Terminal Missing Access Control