PT-2025-44514 · Nagios · Nagios Log Server

Published 2025-07-22 · Updated 2025-10-31 · CVE-2025-34271

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R2.0.2

Description The software contains a flaw in the cluster manager component related to handling sensitive credentials. When requesting credentials from peer nodes, the communication occurs over an unencrypted channel, even with SSL/TLS enabled in the product configuration. This allows an attacker on the network to intercept credentials during transmission. Successful interception of these credentials could allow an attacker to authenticate as a cluster node or service account, potentially leading to unauthorized access, lateral movement, or system compromise.

Recommendations Update Nagios Log Server to version 2024R2.0.2 or later.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2025-15424

CVE-2025-34271

Affected Products

Nagios Log Server

References · 8

• https://nagios.com/changelog/#log-server · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-34271 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34271 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15424 · Security Note
• https://twitter.com/CVEnew/status/1984012723106075134 · Twitter Post
• https://vulncheck.com/advisories/nagios-log-server-cluster-manager-credential-requests-sent-over-plaintext · Note
• https://nagios.com/products/security/#log-server-2024R2 · Patch, Vendor Advisory
• https://t.me/CVEtracker/36236 · Telegram Post