PT-2025-44511 · Nagios Enterprises · Nagios Xi

Published 2025-10-30 · Updated 2025-10-30 · CVE-2025-34135

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.4.2

Description Nagios XI versions prior to 2024R1.4.2 configure certain systemd unit files with overly permissive permissions. Specifically, the nagios.service unit possesses unnecessary executable permissions. These permissions can expand the local attack surface, potentially enabling unintended execution or facilitating abuse of service operations when combined with other weaknesses.

Recommendations Update Nagios XI to version 2024R1.4.2 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2025-14491

CVE-2025-34135

Affected Products

Nagios Xi

References · 8

• https://bdu.fstec.ru/vul/2025-14491 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34135 · Security Note
• https://nagios.com/changelog/nagios-xi · Patch
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44511?fts[value]=CVE-2025-34135 · Note
• https://vulncheck.com/advisories/nagios-xi-overly-permissive-permissions-on-systemd-unit-files · Note
• https://twitter.com/CVEnew/status/1984015872520855957 · Twitter Post