dbcve.org
Log ServerApplication · Nagios

CVE-2025-34323

HIGH · 7.8 CVSS v3.1 Published 2025-11-17
Fix available
A fix is available. Upgrade to 2026 or later.
See remediation →
80/100
Remediation priority · High
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. The 'www-data' user is a member of the 'nagios' group, which has write access to '/usr/local/nagioslogserver/scripts', while several scripts in this directory are owned by root and may be executed via sudo without a password. A local attacker running as 'www-data' can move one of these root-owned scripts to a backup name and create a replacement script with attacker-controlled content at the original path, then invoke it with sudo. This allows arbitrary commands to be executed with root privileges, providing full compromise of the underlying operating system.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Nagios Log Server versions prior to 2026R1.0.1 contain a local privilege escalation vulnerability where the www-data user, as a member of the nagios group, has write access to /usr/local/nagioslogserver/scripts. Several root-owned scripts in this directory are executable via sudo without a password. An attacker can rename a root-owned script, create a malicious replacement at the original path, and execute it with sudo to gain root privileges.

MitigationRemedy the sudo misconfiguration by removing passwordless sudo rules for scripts in /usr/local/nagioslogserver/scripts, revoke group write access from the nagios group on that directory, and remove www-data from the nagios group if possible; alternatively, upgrade to version 2026R1.0.1 or later.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Log ServerApplication
Affected:< 2026= 2026

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Nagios Log Server installation
    Check if the directory /usr/local/nagioslogserver exists on the system
    Affected if The directory does not exist - Nagios Log Server is not installed and this CVE does not apply
  2. Determine installed Nagios Log Server version
    Check for version information in /usr/local/nagioslogserver or by running 'nagioslogserver --version' if available; compare against affected versions (< 2026 or = 2026)
    Affected if The installed version is prior to 2026 or equals 2026 exactly
  3. Verify www-data user group membership
    Run 'id www-data' or 'groups www-data' to check if www-data is a member of the nagios group
    Affected if www-data is a member of the nagios group
  4. Check write permissions on scripts directory
    Run 'ls -la /usr/local/nagioslogserver/scripts' and verify group write permissions for the nagios group
    Affected if The nagios group has write permission on /usr/local/nagioslogserver/scripts
  5. Identify sudo rules for scripts directory
    Run 'sudo -l' as www-data user (or check /etc/sudoers and /etc/sudoers.d/) for passwordless sudo rules targeting scripts in /usr/local/nagioslogserver/scripts
    Affected if There are passwordless sudo rules allowing execution of scripts in /usr/local/nagioslogserver/scripts

A system is affected if Nagios Log Server version is < 2026 or = 2026, www-data is in the nagios group, the scripts directory is group-writable, and passwordless sudo rules exist for scripts in that directory.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 2026 or later
Fixed in 2026
Interim mitigation

Remedy the sudo misconfiguration by removing passwordless sudo rules for scripts in /usr/local/nagioslogserver/scripts, revoke group write access from the nagios group on that directory, and remove www-data from the nagios group if possible; alternatively, upgrade to version 2026R1.0.1 or later.

Recommended fix High confidence

2026R1.0.1

  1. 1. Identify the current installed version of Nagios Log Server using: rpm -q nagioslogserver or dpkg -l nagioslogserver
  2. 2. Back up all Nagios Log Server configuration files, databases, and any custom scripts in /usr/local/nagioslogserver/ before proceeding
  3. 3. Download the fixed version 2026R1.0.1 or later from the official Nagios download portal at www.nagios.com
  4. 4. Install the upgrade package using the appropriate package manager for your system (e.g., rpm -Uvh for RHEL/CentOS or dpkg -i for Debian)
  5. 5. Verify the upgrade was successful by checking the new version: nagioslogserver --version or rpm -q nagioslogserver
  6. 6. Ensure the sudo configuration no longer allows passwordless execution of scripts in /usr/local/nagioslogserver/scripts for the nagios group or www-data user
  7. 7. Restart the Nagios Log Server services to apply changes
  8. 8. Verify the fix by confirming that /usr/local/nagioslogserver/scripts/ is no longer group-writable by the nagios group
Caveat Review Nagios Log Server 2026R1.0.1 release notes for any configuration or feature changes that may affect your deployment

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Log Server Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA1.0 h
7.0 hours of engineering $1,240
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-34323 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-34323 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data