PT-2025-47178 · Nagios · Nagios Log Server

Published 2025-11-17 · Updated 2025-11-17 · CVE-2025-34322

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2026R1.0.1

Description Nagios Log Server versions prior to 2026R1.0.1 have an authenticated command injection issue through the 'Natural Language Queries' feature. The application reads configuration values for this feature from application settings and uses them in a system command without proper validation of special characters. An authenticated user with access to global configuration can leverage this to execute arbitrary operating system commands with the privileges of the web server account, potentially compromising the Log Server host.

Recommendations Update Nagios Log Server to version 2026R1.0.1 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-14541

CVE-2025-34322

Affected Products

Nagios Log Server

References · 9

• 🔥 https://theyhack.me/Rooting-Nagios-Log-Server · Exploit
• https://osv.dev/vulnerability/CVE-2025-34322 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34322 · Security Note
• https://bdu.fstec.ru/vul/2025-14541 · Security Note
• https://nagios.com/changelog/nagios-log-server/nagios-log-server-2026r1-0-1 · Patch
• https://twitter.com/VulmonFeeds/status/1990516116595106074 · Twitter Post
• https://vulncheck.com/advisories/nagios-log-server-authenticated-command-injection-via-natural-language-queries · Note
• https://nagios.com/products/security/#log-server · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1990485787826155551 · Twitter Post