PT-2025-44525 · Nagios · Nagios Log Server

Published 2025-10-30 · Updated 2025-10-31 · CVE-2025-34298

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R1.3.2

Description Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation issue in the account email-change workflow. A user can set their email to an invalid value, and due to inadequate validation and authorization checks related to email identity state, this can cause an inconsistent account state. This inconsistent state can grant elevated privileges or bypass intended access controls.

Recommendations Update Nagios Log Server to version 2024R1.3.2 or later.

Fix

LPE

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

BDU:2025-14709

CVE-2025-34298

Affected Products

Nagios Log Server

References · 8

• https://nagios.com/changelog/nagios-log-server-2024r1 · Patch
• https://bdu.fstec.ru/vul/2025-14709 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-34298 · Security Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44525 · Note
• https://twitter.com/VulmonFeeds/status/1984062970939256924 · Twitter Post
• https://vulncheck.com/advisories/nagios-log-server-set-email-privilege-escalation · Note
• https://t.me/CVEtracker/36247 · Telegram Post
• https://twitter.com/CVEnew/status/1984012715442991567 · Twitter Post