Nagios Log Server CVE-2025-34277

Exploitation requires an authenticated session on Nagios Log Server with at least low-level privileges (CVSS PR:L) - it is NOT exploitable by unauthenticated attackers - and the ability to reach the dashboard functionality that accepts a dashboard ID value which is forwarded to the internal API. The specific prerequisite is the capacity to supply a crafted/malformed dashboard ID through that dashboard workflow; no special non-default product configuration, platform, or user interaction is stated as required (AT:N/UI:N). The primary limiting factor is therefore the authentication requirement; realistic risk is highest in deployments where low-privilege accounts are broadly provisioned or where the application is network-exposed to semi-trusted users.

This is a credible priority rather than a high-CVSS-but-low-risk issue, though the risk is gated by one key factor. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring no user interaction, and CWE-94 code injection yielding arbitrary code execution in the Log Server process context - a severe technical impact (VC:H/VI:H/VA:H). The single most important mitigating signal is PR:L: an attacker needs at least low-privilege authenticated access to the Log Server application, so this is NOT an unauthenticated internet-facing RCE. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the one differentiating intelligence signal is that the flaw was reported by VulnCheck, a credible vulnerability-research vendor, which raises the likelihood that exploitation detail is understood even if not public. Conflicting/missing data: the provided CVSS 4.0 asserts subsequent-system impact (SC:H/SI:H/SA:H) but the description only establishes code execution within the Log Server process itself - the subsequent-system scope is not substantiated by the description and should be verified with the vendor. No SSVC decision data was supplied.

An attacker with a valid low-privilege account on Nagios Log Server submits a crafted, malformed dashboard ID value which is passed unvalidated to an internal API, causing attacker-controlled data to be executed and yielding arbitrary code execution as the Log Server process. Given AV:N/AC:L, this is a single low-complexity network request once authenticated. No public proof-of-concept was identified in the provided data, though the issue is documented in a VulnCheck advisory.