CVE-2024-14003 - CVE House

Back to Database

Status published Critical CVE-2024-14003

Nagios XI < 2024R1.2 RCE via NRDP Server Plugins

9.4 CVSS

Vulnerability Description

Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the underlying host in the context of the web/Nagios service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-14003

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Exodus Intelligence

References

More from Nagios

View All →

Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only...

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve...

Nagios Log Server < 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo Rules

Nagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language Queries

Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation

Affected Vendor

Nagios

View all reports →

Affected Software

XI

Vulnerable Versions:

0

Timeline

Official Publish: October 30th, 2025

Last Modified: November 17th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel