Secuno
ENNL
Book demo

CVE-2025-34298

Nagios Log Server privilege escalation

8.8 HIGHEPSS 0.70%
  1. Published30 Oct 2025

Description

Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent account state that granted elevated privileges or bypassed intended access controls.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Nagios Log Server< 2024 · 2024

Remediation

Fixed in
Nagios Log Server≥ 2024

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-829648.8
Improper preservation of permissions in the Avast sandbox minifilter driver…
CVE-2026-448328.8
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated…
CVE-2026-398329.1
When adding a key to a remote agent constraint extensions such as…
CVE-2026-248349.3
Kata Containers is an open source project focusing on a standard implementation of…
CVE-2025-551309.1
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and…
CVE-2025-436989.1
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards)…

Frequently asked

Is CVE-2025-34298 being actively exploited?

CVE-2025-34298 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.70%.

How severe is CVE-2025-34298?

CVE-2025-34298 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 0.70% probability of exploitation.

Which products are affected by CVE-2025-34298?

Affected products include Nagios Log Server.

How do I fix CVE-2025-34298?

Upgrade affected software to a fixed version, for example Nagios Log Server 2024 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-34298 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.