Nagios XI CVE-2025-34135

Requires local access to a Nagios XI host running a version prior to 2024R1.4.2, where systemd unit files (specifically nagios.service) were installed with unnecessary executable permissions. Exploitation is NOT standalone: the description explicitly states the weakness broadens attack surface and facilitates abuse only 'when combined with other weaknesses,' so a separate vulnerability or existing local foothold is required to achieve meaningful impact. Limiting factors: local-only attack vector (no remote exploitation), low technical impact (partial confidentiality/integrity, no availability), and dependence on chaining, all of which sharply reduce realistic risk despite the 5.1 base score.

This is a low-to-moderate hardening flaw, not an urgent priority. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N, 5.1 Medium) confirms a LOCAL attack vector with only LOW confidentiality and integrity impact and no availability impact - consistent with CWE-732 (incorrect permission assignment). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automatable exploitation. Critically, the description itself frames this as a defense-in-depth weakness that 'broadens local attack surface' and facilitates abuse 'when combined with other weaknesses' - meaning it is not directly exploitable on its own and provides value only as a link in a larger local privilege-escalation chain. One inconsistency to verify: the vendor vector states PR:N (no privileges), yet an AV:L flaw involving abuse of local service unit files realistically presupposes some local foothold; treat 'unauthenticated local' with caution and assume an attacker already has local access. Overall: real but low-severity, requires local access and chaining, no exploitation signals.

An attacker who already has a local, low-privileged foothold on a Nagios XI host (e.g., via a separate web vulnerability or a compromised low-priv account) discovers that the nagios.service systemd unit file carries unnecessary executable permissions. They leverage this overly permissive configuration together with another weakness to influence service execution behavior and move toward higher privileges. No public exploit code is identified at time of analysis, and success depends on chaining with an additional flaw.