Vulnerability · Published Oct 30, 2025 · Assigned by VulnCheck

CVE-2024-14009Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile

Critical 9.4

In plain English

A critical-severity privilege mismanagement in XI from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)1.2%top 31.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and unsafe handling of exported/imported profile data and operations, an authenticated administrator could exploit this vulnerability to execute actions on the underlying XI host outside the application's security scope. Successful exploitation may allow an administrator to obtain root privileges on the XI server.

Affected products (as reported)

Vendor	Product	Versions
Nagios	XI	0 – before 2024R1.0.1

Weakness: CWE-269 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.nagios.com/products/security/#nagios-xi vendor-advisory, patch
https://www.nagios.com/changelog/nagios-xi/ release-notes, patch
https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-system-profile third-party-advisory