CVE-2025-34134
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedNagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters (notably bpi_logfile and bpi_configfile) allow an authenticated administrative user to cause the product to create or overwrite files within the webroot and subsequently edit them via the BPI configuration editor. When such files carry executable extensions and are served by the web application, arbitrary code may be executed in the context of the web application user. Successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain further control of the underlying host operating system.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceNagios XI versions prior to 2024R1.4.2 contain an RCE vulnerability in the BPI component where insufficient validation of bpi_logfile and bpi_configfile parameters allows authenticated administrators to write arbitrary files to the webroot with executable extensions, leading to code execution as the web application user.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2024= 2024CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Nagios XI installation and versionLocate the Nagios XI installation directory and check the version file. Typically found in /usr/local/nagiosxi or via 'cat /usr/local/nagiosxi/etc/xi-version.txt' or checking the web interface footer version display.Affected if The installed version is prior to 2024R1.4.2 or the version cannot be determined.
-
Confirm BPI component is presentCheck for the existence of the BPI (Business Process Intelligence) component in the Nagios XI installation. Look for bpi-related directories or files in the /usr/local/nagiosxi/ directory, or check if BPI is listed in the available components.Affected if The BPI component directory or configuration files exist on the system.
-
Inspect BPI configuration for suspicious parametersExamine the BPI configuration files for bpi_logfile and bpi_configfile parameters. Look in the BPI config directory for any .cfg or .xml files containing these parameters with non-standard paths.Affected if The bpi_logfile or bpi_configfile parameters point to locations outside the expected BPI directory, or to executable file locations in the webroot.
-
Scan webroot for unexpected executable filesReview the Nagios XI webroot directory (typically /usr/local/nagiosxi/html/) for newly created executable files (.php, .sh, .pl, .py) that were not part of a legitimate installation, especially in locations writable via the BPI component.Affected if Unexpected executable files exist in the webroot that cannot be attributed to legitimate Nagios XI components or updates.
A system is affected if it runs Nagios XI versions prior to 2024R1.4.2 and has the BPI component enabled, with potential indicators including suspicious bpi_logfile/bpi_configfile paths or unexpected executable files in the webroot.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2024
Upgrade to Nagios XI 2024R1.4.2 or later to remediate this vulnerability. Until upgraded, limit administrative access and monitor for unauthorized BPI configuration changes.
Nagios XI 2024R1.4.2 or later
- Backup the Nagios XI system (database, configuration files, and /usr/local/nagios directory) before proceeding with any upgrade
- Download Nagios XI 2024R1.4.2 or later from the official Nagios website (https://www.nagios.com/products/nagios-xi/)
- Run the Nagios XI upgrade wizard by navigating to Admin > System Extensions > Update in the web interface, or use the offline/online upgrade method appropriate for your installation
- Follow the on-screen upgrade instructions to complete the update to version 2024R1.4.2
- After upgrade, verify the BPI component functionality by navigating to the Business Process Intelligence section
- Confirm the web application is functioning correctly and monitor for any unexpected behavior
- Review audit logs to ensure no unauthorized changes occurred during the vulnerability window
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation2.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-34134 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-34134 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data