Critical severity9.8NVD Advisory· Published Oct 30, 2025· Updated Jun 17, 2026
CVE-2025-34271
CVE-2025-34271
Description
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
16<2024R2.0.2+ 15 more
- (no CPE)range: <2024R2.0.2
- (no CPE)range: 0
- cpe:2.3:a:nagios:log_server:*:*:*:*:*:*:*:*range: <2024
- cpe:2.3:a:nagios:log_server:2024:r1:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r1.0.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r1.0.2:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r1.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r1.2:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r1.3:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r1.3.1:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r1.3.2:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r1.3.3:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r1.3.4:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r1.3.5:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r2:*:*:*:*:*:*
- cpe:2.3:a:nagios:log_server:2024:r2.0.1:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
3- www.nagios.com/products/security/nvdVendor Advisory
- www.vulncheck.com/advisories/nagios-log-server-cluster-manager-credential-requests-sent-over-plaintextnvdThird Party Advisory
- www.nagios.com/changelog/nvdRelease Notes
News mentions
0No linked articles in our index yet.