CVE-2025-34271
Critical
Description
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise.
SeverityCritical
CVSS9.8
Exploit probability—
ProductNagios Log Server
PublishedOct 30, 2025
First seenOct 30, 2025
Weakness typeCWE-319CWE-319
How to fix
Update
- nagios log_server2024 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nagios log_server | v < 2024, 2024 | 2024 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.