Vulnerability · Published Oct 30, 2025 · Assigned by VulnCheck
CVE-2024-14002Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis
High 7.1
In plain English
A high-severity security flaw in XI from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)1.7%top 23.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.
Affected products (as reported)
Weakness: CWE-98 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://www.nagios.com/products/security/#nagios-xi vendor-advisory, patch
- https://www.nagios.com/changelog/nagios-xi/ release-notes, patch
- https://www.vulncheck.com/advisories/nagios-xi-authenticated-local-file-inclusion-via-nagvis third-party-advisory