Nagios Network Analyzer CVE-2025-34280

Exploitation requires the attacker to already be an authenticated administrator of the Nagios Network Analyzer web application (CVSS PR:H), and requires reaching the LDAP certificate management functionality - specifically triggering the certificate removal operation, which implies LDAP authentication/certificate features are configured and in use. The limiting factors are substantial: valid administrator-level credentials are mandatory, so this is a post-authentication flaw, not remotely exploitable against default unauthenticated deployments; the affected deployment must also run a version prior to 2024R2.0.1. Resulting code execution is confined to the privileges of the web application service account, not necessarily root.

This is a CWE-78 OS command injection in Nagios Network Analyzer's LDAP certificate removal function, rated CVSS 4.0 8.6 (High). The attack vector is network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but critically requires high privileges (PR:H) - the input vector confirms an already-authenticated administrator. Impact is full on the vulnerable system (VC:H/VI:H/VA:H) with no scope change (SC:N/SI:N/SA:N), consistent with RCE confined to the web service's privilege context. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The PR:H requirement is the dominant mitigating factor: this is a privilege-escalation-to-host primitive available to someone who already holds admin on the application, not an unauthenticated internet-facing RCE. It is a genuine post-authentication risk (an admin-tier web user gaining OS-level code execution on the monitoring host) rather than a mass-exploitation priority. No conflicting signals are present, but note that all severity data derives solely from the CVSS 4.0 vector supplied by the reporter (VulnCheck); independent exploitation telemetry (EPSS/KEV) is absent, not confirmed-negative.

An attacker who has obtained or abused Nagios Network Analyzer administrator credentials navigates to the LDAP certificate management interface and invokes the certificate removal operation with a crafted value containing shell metacharacters. Because the input is not sanitized before being passed to an OS command, the payload executes arbitrary commands on the underlying host as the web application service account, yielding remote code execution. No public exploit code was identified at time of analysis.