Nagios Log Server CVE-2025-34271

Exploitation requires (1) a clustered Nagios Log Server deployment prior to 2024R2.0.2 where the cluster manager requests credentials from peer nodes, and (2) the attacker holding an adversary-in-the-middle position on the network path between cluster nodes to intercept the plaintext exchange. Critically, enabling SSL/TLS in the product configuration does NOT mitigate this specific channel - the credential request is sent unencrypted regardless. Limiting factors: the attacker must achieve a privileged network interception position (not achievable by a purely remote external attacker without a foothold), and single-node installations with no inter-node cluster credential exchange are not exposed; the impact is confined to credential disclosure (confidentiality), which then enables follow-on authentication and lateral movement.

This is a cleartext-transmission flaw (CWE-319) in the Nagios Log Server cluster manager, which requests sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) scores 8.7 (High) and models it as a trivially remote, unauthenticated confidentiality breach. However, the description makes clear that exploitation requires an attacker to be 'positioned on the network path' to intercept credentials in transit - i.e. an adversary-in-the-middle (AITM) position - which is a meaningful precondition the vendor's AC:L/AT:N rating arguably understates; a more honest reading warrants higher attack complexity/attack requirements (see assessed vectors below). No EPSS score, CISA KEV listing, or public exploit was provided in the intelligence set, so there is no public exploit identified at time of analysis. Net assessment: a genuine design defect worth remediating because it silently defeats an SSL/TLS configuration operators believe is protecting them, but its real-world priority is tempered by the need for privileged network positioning between cluster nodes rather than internet-wide drive-by exploitation. Treat as a moderate-to-high priority for clustered deployments on untrusted or shared network segments, lower for single-node or fully isolated cluster networks.

An attacker who has gained a foothold on a network segment carrying traffic between Nagios Log Server cluster nodes (e.g. a compromised host, rogue device, or ARP/DNS spoofing position) passively captures the plaintext credential exchange performed by the cluster manager, despite SSL/TLS being enabled in the product. With the intercepted cluster node or service-account credentials, the attacker then authenticates to the cluster and pivots to further unauthorized access and lateral movement. No public exploit code is identified at time of analysis; the attack relies on standard network interception tooling rather than a dedicated PoC.