Nagios Network Analyzer < 2024R2.0.1 RCE in LDAP Certificate Removal Function
Priority MEDIUM 48CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command execution on the underlying host in the context of the web application service, resulting in remote code execution with the service's privileges.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01428 73rd percentileScored 2026-11-07
Fix Fixed Network Analyzer (Nagios): 2024R2.0.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Nagios | Network Analyzer | before 2024R2.0.1 | 2024R2.0.1 | Patch available | CNA |
- Network Analyzer VendorNagios Affected before 2024R2.0.1 Fixed in 2024R2.0.1 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nagios:network_analyzer:*:*:*:*:*:*:*:* | before 2024 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:network_analyzer:2024:r1.0.1:*:*:*:*:*:* | 2024 r1.0.1 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:network_analyzer:2024:r1.0.2:*:*:*:*:*:* | 2024 r1.0.2 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:network_analyzer:2024:r1.0.3:*:*:*:*:*:* | 2024 r1.0.3 | Vulnerable | Nagios |
| cpe:2.3:a:nagios:network_analyzer:2024:r2:*:*:*:*:*:* | 2024 r2 | Vulnerable | Nagios |
- cpe:2.3:a:nagios:network_analyzer:*:*:*:*:*:*:*:* Versions before 2024 Vulnerable ·Nagios
- cpe:2.3:a:nagios:network_analyzer:2024:r1.0.1:*:*:*:*:*:* Versions 2024 r1.0.1 Vulnerable ·Nagios
- cpe:2.3:a:nagios:network_analyzer:2024:r1.0.2:*:*:*:*:*:* Versions 2024 r1.0.2 Vulnerable ·Nagios
- cpe:2.3:a:nagios:network_analyzer:2024:r1.0.3:*:*:*:*:*:* Versions 2024 r1.0.3 Vulnerable ·Nagios
- cpe:2.3:a:nagios:network_analyzer:2024:r2:*:*:*:*:*:* Versions 2024 r2 Vulnerable ·Nagios
Remediation
- Fix · CNA Network Analyzer (Nagios) Fixed in 2024R2.0.1
Timeline
- 2026-10-02 Threatist record created from CVE-2025-34280
- 2026-10-03 Alias added: GHSA-vg8x-3rq9-ch3c
References
More Nagios Network Analyzer vulnerabilities
- TI-2021-09866 SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/. CVSS 3.1CRITICAL 9.8
- TI-2025-20700 An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted… CVSS 3.1HIGH 7.5
- TI-2021-09865 Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page. CVSS 3.1MEDIUM 6.1
- TI-2025-24417 Nagios Network Analyzer < 2024R1 Source Groups / Percentile Calculator Menu Stored XSS CVSS 4.0MEDIUM 5.1
- TI-2023-06686 Nagios Network Analyzer < 2024R1 XSS via Percentile Calculator Menu CVSS 4.0MEDIUM 5.1
- TI-2025-20724 A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows… CVSS 3.1MEDIUM 4.6
Sources
- CVE-2025-34280 · CVE Program
- CVE-2025-34280 · NVD
- FIRST EPSS
- GHSA-vg8x-3rq9-ch3c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences