PT-2025-44518 · Nagios · Nagios Log Server

Institute · Published 2025-02-04 · Updated 2025-10-31 · CVE-2025-34277

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R1.3.1

Description The software contains a code injection issue stemming from inadequate validation of dashboard ID values before they are processed by an internal API. An attacker can leverage crafted dashboard ID values to execute arbitrary code within the Log Server process. The affected API receives dashboard ID values without proper sanitization, allowing for potential code execution. The vulnerable parameter is the dashboard ID.

Recommendations Update to version 2024R1.3.1 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-15425

CVE-2025-34277

Affected Products

Nagios Log Server

References · 10

• https://osv.dev/vulnerability/CVE-2025-34277 · Vendor Advisory
• https://nagios.com/changelog/#log-server-2024R1 · Patch
• https://bdu.fstec.ru/vul/2025-15425 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-34277 · Security Note
• https://twitter.com/CVEnew/status/1984012716428697898 · Twitter Post
• https://t.me/CVEtracker/36240 · Telegram Post
• https://twitter.com/0dayPublishing/status/1984318090977394890 · Twitter Post
• https://nagios.com/products/security/#log-server · Patch, Vendor Advisory
• https://vulncheck.com/advisories/nagios-log-server-rce-via-malformed-dashboard-id · Note
• https://twitter.com/offseq/status/1984138411238662439 · Twitter Post