PT-2025-44524 · Nagios Enterprises · Nagios Xi

Published

2025-10-30

·

Updated

2025-10-31

·

CVE-2025-34287

CVSS v4.0
8.4
VectorAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R2
Description Nagios XI versions prior to 2024R2 contain an improperly owned script, 
process perfdata.pl
, which is executed periodically as the 
nagios
user but owned by 
www-data
. Because the file was writable by 
www-data
, an attacker with web server privileges could modify its contents, leading to arbitrary code execution as the 
nagios
user when the script is next run. This improper ownership and permission configuration enables local privilege escalation.
Recommendations Update Nagios XI to version 2024R2 or later. As a temporary workaround, restrict write access to the 
process perfdata.pl
script for the 
www-data
user.

Fix

LPE

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2025-14702
CVE-2025-34287

Affected Products

Nagios Xi