CVE-2025-34277 - CVE House

Back to Database

Status published Critical CVE-2025-34277

Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID

9.4 CVSS

Vulnerability Description

Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to execute attacker-controlled data, leading to arbitrary code execution in the context of the Log Server process.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34277

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Institute of Information Engineering, CAS

References

More from Nagios

View All →

Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only...

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve...

Nagios Log Server < 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo Rules

Nagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language Queries

Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation

Affected Vendor

Nagios

View all reports →

Affected Software

Log Server

Vulnerable Versions:

0

Timeline

Official Publish: October 30th, 2025

Last Modified: November 17th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation