Local Privilege Escalation Vulnerability in NSClient++ by NSClient Inc.
CVE-2025-34078
Key Information:
- Vendor
Nsclient++
- Status
- Vendor
- CVE Published:
- 2 July 2025
Badges
What is CVE-2025-34078?
A potential local privilege escalation risk exists in NSClient++ 0.5.2.35 due to improper handling of credentials. When both the web interface and ExternalScripts capabilities are active, the configuration file (nsclient.ini) exposes the administrative password in plaintext format. Local users can read this sensitive information, allowing them to authenticate to the web interface, commonly on port 8443. By exploiting this vulnerability, a malicious actor can leverage the ExternalScripts plugin to execute arbitrary commands with SYSTEM privileges by crafting custom scripts and triggering them through the API. The plaintext password vulnerability undermines proper access controls, posing significant security implications.
Affected Version(s)
NSClient++ Windows 0.5.2.35
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved