CVE-2025-34270: medium-severity vulnerability in Nagios Log Server
Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.6%
exploitation probability
0.6%top 52% of all CVEs
observed exploitation
nono source reports it
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Nagios · Log ServerRelated CVEs — Nagios Log Server
In the same product, most dangerous first.
CVE-2025-44823CRITICALCVE-2025-44823EPSS 16.1%CVE-2025-34322HIGHNagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language QueriesEPSS 9.5%CVE-2025-44824HIGHCVE-2025-44824EPSS 2.8%CVE-2025-34277CRITICALNagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard IDEPSS 2.2%CVE-2025-34274CRITICALNagios Log Server < 2024R2.0.3 Logstash Process Root PrivilegesEPSS 2.1%CVE-2023-7322HIGHNagios Log Server < 2024R1 Incorrect Authorization Granting Full API AccessEPSS 1.1%
References
https://support.nagios.com/kb/article/authenticating-and-importing-users-with-ad-and-ldap-995.htmlhttps://www.nagios.com/changelog/#log-serverhttps://www.nagios.com/products/security/#log-server-2024R2https://www.vulncheck.com/advisories/nagios-log-server-ad-ldap-import-password-not-obfuscated