CVE-2025-34277 is a critical code injection flaw (CVSS 9.8) in Nagios Log Server. Malformed dashboard ID values are not validated before being passed to an internal API, which lets an attacker run code as the Log Server process. Versions before 2024R1.3.1 are affected. Upgrade to 2024R1.3.1 or later.
What's affected
The record says Nagios Log Server versions prior to 2024R1.3.1 are affected. The advisory credits the Institute of Information Engineering, CAS, for the report.
The flaw is in how dashboard identifiers are handled. The CVSS vector in the record shows the attack needs only network access and no user interaction, and the VulnCheck advisory shows a low privilege requirement, so assume that any account that can reach the interface is a possible starting point. Check the Nagios changelog for the fixed release on your release line.
How to check if you're exposed
Read the version from the Log Server web interface. If it is older than 2024R1.3.1, you are in the affected range.
Next, consider who can reach the web interface. A Log Server open to a wide internal network or to the internet has more exposure than one limited to an admin subnet. List the accounts that can log in and remove any that are unused.
Your web server access logs are also worth a look. The record does not publish indicators, so use them for context about who has been using dashboard URLs, rather than as a detection method. If you see unfamiliar clients, treat the host as suspect and follow your incident process.
What to do now
- Upgrade Nagios Log Server to 2024R1.3.1 or later. If you are on the 2024R2 branch, move to the latest release from the changelog, which also fixes related issues.
- Restrict access to the web interface with a firewall rule or VPN so only administrators can reach it.
- Remove stale user accounts and enforce strong passwords for the rest.
- Run the service with the least privilege possible. Releases from 2024R2.0.3 run embedded Logstash as a non root user, as described in a related advisory.
- Watch for unexpected processes or outbound connections from the Log Server host, and investigate if you find any.
Why it matters
The class is CWE-94 (Improper Control of Generation of Code). A value that should be a simple identifier is treated in a way that lets attacker supplied data be executed. Identifiers feel harmless, so they are often passed through without strict checks. The remedy is an allow list: accept only the exact format an ID can have and reject everything else before it reaches an internal API.
A Log Server holds logs from many systems, and code execution on it can expose that data and any credentials stored on the host. The record does not list the CVE in CISA KEV, but that does not lower the priority for an internet facing instance.
Quick check
Does an attacker need to log in?
The VulnCheck advisory vector shows low privileges required, so some account access may be needed. Treat any reachable instance as exposed and patch.
What is the fixed version?
2024R1.3.1 for the 2024R1 branch. The 2024R2 branch has later releases, so use the changelog to choose.
Sources
Last reviewed: 18 October 2026.
