Local Privilege Escalation in Nagios Log Server by Nagios

CVE-2025-34323

What is CVE-2025-34323?

Nagios Log Server versions before 2026R1.0.1 are susceptible to local privilege escalation. This issue arises from an unsafe interaction between sudo rules and file system permissions. The web server account possesses passwordless sudo access to particular maintenance scripts and concurrently belongs to a group with write access to the directory where these scripts are stored. A local attacker, acting as the web server user, can replace one of the allowed scripts with a malicious executable and subsequently invoke it through sudo, leading to arbitrary code execution with root privileges.

References