CVE-2025-34280CWE-78command-injection

CVE-2025-34280

High · published October 31, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
72.8
In the wild
Unconfirmed
What it is

🚨 An authenticated admin can unleash remote code execution just by mishandling an LDAP certificate! 🔥 Think of it like a maintenance worker who accidentally drops the keys to a secure server room, letting anyone access sensitive equipment without a proper check. One simple misstep, and the whole place is at risk! With this vulnerability, an attacker could exploit the faulty input sanitation in the Nagios Network Analyzer, allowing them to execute commands on the host system. This could lead to unauthorized access, data breaches, or even complete control over the web application service, compromising your entire network!

Put simply

Think of it like a maintenance worker who accidentally drops the keys to a secure server room, letting anyone access sensitive equipment without a proper check. One simple misstep, and the whole place is at risk! CVE-2025-34280 arises from inadequate input sanitation during the certificate removal operation in Nagios Network Analyzer. Authenticated administrators can inadvertently trigger command execution on the underlying host due to this flaw, granting attackers access with the service's privileges.

What to do

With this vulnerability, an attacker could exploit the faulty input sanitation in the Nagios Network Analyzer, allowing them to execute commands on the host system. This could lead to unauthorized access, data breaches, or even complete control over the web application service, compromising your entire network! To safeguard against this vulnerability, upgrade Nagios Network Analyzer to version 2024R2.0.1 or later immediately. Additionally, review your LDAP certificate management practices to ensure adequate input validation is in place. Regular audits of user permissions can also help prevent unauthorized access. You've got this! Follow these steps, and you'll keep your network secure in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01428 · 72.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-31T02:15Z
Affected products (5)
ProductVersionsFixed in
nagios/network_analyzer< 20242024
nagios/network_analyzerall versions—
nagios/network_analyzerall versions—
nagios/network_analyzerall versions—
nagios/network_analyzerall versions—
References (3)
EPSS history
Timeline
  • 30 OCT 21:27Z
    Nagios Network Analyzer < 2024R2.0.1 RCE in LDAP Certificate Removal Function
    cvelistv5