Vulnerability · Published Oct 30, 2025 · Assigned by VulnCheck

CVE-2025-34277Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID

Critical 9.4

In plain English

A critical-severity code injection in Log Server from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)2.2%top 17.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to execute attacker-controlled data, leading to arbitrary code execution in the context of the Log Server process.

Affected products (as reported)

Vendor	Product	Versions
Nagios	Log Server	0 – before 2024R1.3.1

Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.nagios.com/products/security/#log-server vendor-advisory, patch
https://www.nagios.com/changelog/#log-server-2024R1 release-notes, patch
https://www.vulncheck.com/advisories/nagios-log-server-rce-via-malformed-dashboard-id third-party-advisory