CVE-2021-37344

What it actually does

This vulnerability is an unauthenticated network-accessible OS command injection in the Nagios XI Switch Wizard prior to version 2.5.7. The wizard fails to properly neutralize shell metacharacters in user-controllable input before constructing operating system commands, allowing an attacker to inject arbitrary commands that execute with the privileges of the Nagios XI web application or related service account. Successful exploitation can provide full compromise of monitoring data, credential material accessible to the application, configuration files, monitored host inventory, and potentially the underlying server depending on local privileges and hardening.

Why it matters to the business

A vulnerable Nagios XI deployment can be turned from a monitoring platform into an attacker foothold. Because Nagios commonly has broad visibility into critical infrastructure, stored monitoring credentials, hostnames, IP addresses, service checks, and alerting workflows, compromise can expose sensitive operational details, disrupt monitoring, hide outages or attacks, and support lateral movement. The CVSS score is critical and the EPSS score is very high, indicating a high probability of exploitation activity despite no KEV listing, so internet-exposed or broadly reachable instances should be treated as urgent remediation targets.

How an attack unfolds

An attacker identifies a Nagios XI instance exposing the vulnerable Switch Wizard functionality. They send a crafted HTTP request containing shell metacharacters in a parameter processed by the wizard. Because vulnerable versions pass this input into an operating system command without safe argument handling, the injected payload is interpreted by the shell and executed on the server. Initial commands are often used to confirm execution, such as invoking network callbacks, writing a temporary file, or running discovery commands. The attacker may then download a web shell or reverse shell, enumerate Nagios XI configuration and credentials, inspect monitored assets, alter checks or notifications, and use the monitoring server’s network access to pivot toward internal systems.

How to fix it

Upgrade the Nagios XI Switch Wizard component to version 2.5.7 or later. If the wizard is bundled with the Nagios XI installation, update Nagios XI and all included wizards/plugins through the vendor-supported upgrade path. If immediate upgrade is not possible, restrict access to Nagios XI and wizard endpoints to trusted administrative networks or VPNs, disable or remove the Switch Wizard if not required, enforce web application authentication and network-layer access controls, and block outbound connections from the Nagios server except where explicitly required. Review local service privileges and ensure the web server/Nagios processes run with least privilege. Rotate credentials stored in or accessible to Nagios XI if compromise is suspected.

How to confirm the fix worked

Confirm the installed Switch Wizard version is 2.5.7 or later, or verify through the Nagios XI administrative interface or filesystem that the vulnerable wizard has been updated or removed. Validate that Nagios XI is not directly exposed to untrusted networks and that access controls restrict administrative and wizard functionality. Perform an authenticated configuration review to ensure vendor updates were applied successfully and no custom or legacy wizard files remain. Where safe and authorized, use a vulnerability scanner or controlled proof-of-concept check to confirm command injection payloads are rejected or treated as inert input. After patching, verify Nagios XI services, checks, notifications, and plugins still function as expected.

Typical attack path

1. Discover a reachable Nagios XI instance and determine that the Switch Wizard component is present and older than version 2.5.7.
2. Send a crafted HTTP request to the vulnerable wizard endpoint with command separators or shell metacharacters embedded in an expected input field.
3. Execute a benign command to confirm remote command execution, such as creating a file, running id/whoami, or triggering an outbound DNS/HTTP callback.
4. Deploy a persistence mechanism, web shell, or reverse shell under the privileges of the Nagios XI web service account.
5. Enumerate Nagios XI configuration files, monitoring credentials, host inventories, plugins, scripts, and network reachability.
6. Modify monitoring behavior, steal credentials, or pivot to monitored infrastructure using available secrets and trusted network paths.

How to detect it

Investigate historical access logs for suspicious requests to Nagios XI Switch Wizard paths, especially requests containing shell metacharacters, URL-encoded command separators, command substitution syntax, or references to common execution utilities. Review Apache/httpd access and error logs, Nagios XI logs, system authentication logs, shell histories for the web service user, cron directories, temporary directories, and web-accessible directories for artifacts created around suspicious request times. Look for outbound network connections from the Nagios server to unusual IPs or domains shortly after wizard requests, including curl, wget, bash reverse shells, nc/ncat, Python, Perl, or PHP one-liners. Examine Nagios XI configuration, plugin directories, and custom command definitions for unauthorized modifications. Because this is command injection, indicators are often payload-specific; focus on web requests containing encoded metacharacters and subsequent child processes spawned by the web server or Nagios XI process.

• /usr/local/nagiosxi/html/includes/configwizards/switch/
• /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php
• /usr/local/nagiosxi/html/includes/configwizards/switch/steps.php
• /usr/local/nagiosxi/html/includes/configwizards/switch
• ;id
• %3Bid
• ;whoami
• %3Bwhoami
• ;uname
• %3Buname
• ;curl
• %3Bcurl
• ;wget
• %3Bwget
• |curl
• %7Ccurl
• |wget
• %7Cwget
• `id`
• %60id%60
• $(id)
• %24%28id%29
• /bin/bash -c
• bash -i
• /dev/tcp/
• nc -e
• ncat -e
• python -c
• perl -e
• php -r
• /tmp/.
• /var/tmp/.
• /usr/local/nagiosxi/html/*.php

What your security team should do

• Treat internet-facing or broadly reachable Nagios XI servers as high-priority due to critical severity and very high EPSS likelihood.
• Upgrade the Switch Wizard to version 2.5.7 or later, or update Nagios XI through the vendor-supported release that includes the fixed wizard.
• Temporarily restrict Nagios XI access to trusted administrative networks and disable the Switch Wizard until remediation is complete.
• Review web server, Nagios XI, system, and outbound proxy/DNS logs for signs of command execution, web shell deployment, or unusual callbacks.
• Inspect Nagios XI configuration, plugins, custom scripts, and web directories for unauthorized changes or newly created files.
• Rotate monitoring credentials, API tokens, SNMP community strings, SSH keys, and other secrets stored in Nagios XI if exploitation cannot be ruled out.
• Confirm the Nagios XI host runs with least privilege and has egress filtering to reduce the impact of future command execution flaws.