CVE-2025-34271: nagios log_server

Vulnerability summary

CVE-2025-34271 is a critical (CVSS 9.8) vulnerability in nagios log_server. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 54.1% of scored vulnerabilities.

Timeline

1. 30-10-2025
   PublishedVulnerability first disclosed.
2. 17-11-2025
   Last modifiedVulnerability information updated.

Description

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise.

• CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.