Nagios Log Server CVE-2025-34270

Exploitation requires the AD/LDAP user-import feature to be used, and an actor must hold administrator-level access to the Nagios Log Server interface, its logs, or diagnostic output where import results are displayed (PR:H). The limiting factors are significant: this is not remotely exploitable by an unauthenticated attacker, no victim user interaction by a third party is needed, and exposure only occurs on versions prior to 2024R2.0.2 where the password field is not obfuscated. The concrete prerequisite is organizational use of AD/LDAP account import; environments that do not import directory users via this feature are not exposed.

This is a moderate, authentication-gated information-disclosure flaw (CWE-312, cleartext handling of sensitive data), not an urgent internet-facing threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) scores 6.9 and is internally consistent with the description: exploitation yields high confidentiality impact (leaked plaintext credentials) but no integrity or availability impact, and it requires high privileges (PR:H) - i.e., an administrator performing or viewing an AD/LDAP user import. EPSS is low at 0.63% (48th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The signals are coherent rather than conflicting: a low EPSS, absence of KEV, and a PR:H requirement all point to a low-likelihood, admin-dependent exposure rather than mass exploitation. The real risk is contextual - the leaked password may belong to a privileged directory account whose exposure could enable lateral movement, and the 'automatable' potential is low because an attacker must already hold admin access to the Log Server UI/logs. No SSVC decision data was provided in the input, so exploitation-status/automatable/technical-impact cannot be sourced from a vendor SSVC record and are inferred only from CVSS. Treat as a standard-priority patch item, not an emergency.

A Nagios Log Server administrator configures AD/LDAP user import; because the password field is not obfuscated, the plaintext credential supplied for the imported account is rendered in the import-results UI, written to logs, or surfaced in diagnostic output. Any administrator or operator with access to that interface or those logs - or an attacker who has already compromised an admin-level account - can read the exposed directory credential. No public exploit code is referenced; exploitation requires existing privileged access (PR:H) rather than remote unauthenticated interaction.