CVE-2024-58273CWE-266

CVE-2024-58273

High · published October 31, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

⚡ A local privilege escalation vulnerability in Nagios Log Server could let an attacker turn a humble Apache web user into the all-mighty root user! 🔥 Think of it like a restaurant employee who starts in the kitchen but finds a way to sneak into the manager's office and pocket the restaurant's cash — they’ve gone from flipping burgers to holding the keys to the vault! If exploited, an attacker could gain full control over the system, allowing them to access sensitive data, modify logs, or even launch further attacks. The consequences could be absolutely devastating for your server's integrity and your organization's reputation!

Put simply

Think of it like a restaurant employee who starts in the kitchen but finds a way to sneak into the manager's office and pocket the restaurant's cash — they’ve gone from flipping burgers to holding the keys to the vault! CVE-2024-58273 allows a user with command execution privileges as the Apache or backend shell user to escalate their privileges to root, essentially granting them unrestricted access to the host system.

What to do

If exploited, an attacker could gain full control over the system, allowing them to access sensitive data, modify logs, or even launch further attacks. The consequences could be absolutely devastating for your server's integrity and your organization's reputation! To mitigate this risk, upgrade Nagios Log Server to version 2024R1.0.2 or later. Additionally, review user permissions to ensure that only necessary users have access to execute commands as the Apache user. Regular security audits can also help prevent unauthorized privilege escalations. You've got this! With these steps, you can protect your systems and keep your server running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-10-31T02:15Z
Affected products (3)
ProductVersionsFixed in
nagios/log_server< 20242024
nagios/log_serverall versions—
nagios/log_serverall versions—
References (3)
EPSS history
Timeline
  • 30 OCT 21:24Z
    Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root
    cvelistv5