CVE-2025-34273

moderate-risk

Published 2025-10-30

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged users to remove dashboards that affect other users or the overall monitoring UI.

Do I need to act?

0.18% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (15)

Log Server

Affected Vendors

Nagios

References (3)

Release Notes https://www.nagios.com/changelog/#log-server

Vendor Advisory https://www.nagios.com/products/security/#log-server-2024R2

Third Party Advisory https://www.vulncheck.com/advisories/nagios-log-server-non-admin-dashboard-delet...

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 18/34 · Moderate