Vulnerability · Published Oct 30, 2025 · Assigned by VulnCheck

CVE-2025-34135Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files

Medium 5.1

In plain English

A medium-severity incorrect permission assignment in XI from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.4%top 70.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses.

Affected products (as reported)

Vendor	Product	Versions
Nagios	XI	0 – before 2024R1.4.2

Weakness: CWE-732 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://www.nagios.com/products/security/#nagios-xi vendor-advisory, patch
https://www.nagios.com/changelog/nagios-xi/ release-notes, patch
https://www.vulncheck.com/advisories/nagios-xi-overly-permissive-permissions-on-systemd-unit-files third-party-advisory