PT-2025-14370 · Nagios · Nagios Network Analyzer

Published 2025-04-01 · Updated 2025-07-11 · CVE-2025-28131

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nagios Network Analyzer version 2024R1.0.3

Description A Broken Access Control issue allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw arises due to improper authorization enforcement, enabling unauthorized modifications that compromise system integrity and availability.

Recommendations For Nagios Network Analyzer version 2024R1.0.3, consider restricting access to administrative functions until a patch is available, and review user permissions to ensure that low-privilege users cannot perform sensitive actions. As a temporary workaround, consider disabling the ability for "Read-Only" users to stop system services and delete critical resources.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-28131

Affected Products

Nagios Network Analyzer

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-28131 · Security Note
• https://osv.dev/vulnerability/CVE-2025-28131 · Vendor Advisory
• https://t.me/cvetracker/20501 · Telegram Post
• ❌ https://github.com/harshal79/Privilege-Escalation-in-Nagios-Network-Analyzer.git · Note, Deleted
• https://t.me/cvedetector/21776 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1907167341357441513 · Twitter Post
• https://twitter.com/CVEnew/status/1908663719267361053 · Twitter Post
• https://t.me/cvenotify/128533 · Telegram Post
• https://twitter.com/HarshalTem79/status/1912928666105135609 · Twitter Post
• https://nagios.com/changelog/#network-analyzer · Note