Nagios Network Analyzer CVE-2025-34278

Exploitation requires an authenticated account with at least low privileges (PR:L) sufficient to submit input to the Source Groups page percentile-calculator menu, which is where the payload is stored. Realization of impact additionally requires passive user interaction (UI:P): a second victim user must navigate to and render the affected page for the stored script to fire. Limiting factors are therefore twofold - the attacker must already be authenticated to the application, and the attack is not self-contained (it depends on a victim viewing the poisoned page). It affects Nagios Network Analyzer versions prior to 2024R1; upgrading to 2024R1 or later remediates it.

This is a moderate-severity stored XSS (CWE-79) with a vendor/VulnCheck-assigned CVSS 4.0 base score of 5.1. The vector (AV:N/AC:L/AT:N/PR:L/UI:P) indicates network-reachable, low-complexity exploitation that nonetheless requires the attacker to already hold a low-privileged authenticated account and requires passive victim interaction (another user viewing the Source Groups percentile-calculator page). Impact is confined to confidentiality/integrity of a subsequent system (the victim's browser session: SC:L/SI:L) with no availability impact and no direct impact to the vulnerable server itself (VC:N/VI:N/VA:N). The EPSS score of 0.76% (54th percentile) is low-to-moderate, indicating no strong signal of imminent mass exploitation. There is no CISA KEV listing and no public exploit identified, so this is a real but non-urgent issue rather than a drop-everything priority - characteristic of authenticated, interaction-dependent XSS. Note the signals are internally consistent (low EPSS, no KEV, no POC, authenticated+UI-gated vector all point to limited real-world risk); the main caveat is that the only CVSS provided is a 4.0 vector and no independent third-party CVSS 3.1 score is present for cross-validation.

An attacker with a low-privileged authenticated account in Nagios Network Analyzer injects a malicious script payload into the Source Groups page (percentile calculator menu), which the application stores persistently. When a higher-privileged user or administrator later opens that page, the stored script executes in their browser, enabling session hijacking, actions performed as the victim, or theft of displayed data. No public proof-of-concept exploit code was identified at the time of analysis.