Nagios XI CVE-2025-34283

Requires (1) an authenticated Nagios XI account that lacks API privileges - the vulnerability specifically escalates visibility for non-API users - and (2) the instance running one of the Neptune themes, which is the exact rendering path that leaks the API key values. Affected versions are Nagios XI prior to 2024R1.4.2. Exploitation is limited by the need for valid credentials (PR:L) and the non-universal Neptune-theme configuration; instances on other themes or patched to 2024R1.4.2+ are not exposed. Impact is confidentiality-only (key disclosure); the attacker gains no direct integrity or availability effect until the harvested key is separately reused against the API.

This is a genuine but moderate-severity information-disclosure issue, not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:N/VA:N) correctly reflects a network-reachable but authenticated flaw with confidentiality-only impact and no integrity or availability effect - consistent with CWE-497 (exposure of sensitive information). PR:L confirms exploitation requires a valid, albeit low-privilege, Nagios XI account, so this is not a pre-auth internet-wide risk. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this reflects no public exploit identified at time of analysis; the disclosure originates from VulnCheck research rather than observed in-the-wild activity. The primary risk is privilege escalation of exposure: leaked API keys can be replayed against the Nagios XI API, potentially granting the attacker the API-level access they were explicitly denied - so real-world impact hinges on what those API keys authorize. Overall a real but not urgent issue given the authentication requirement, confidentiality-only impact, and absence of exploitation signals.

A low-privilege authenticated Nagios XI user, not granted API access, logs into an instance configured with the Neptune theme and views a page that improperly renders API key values - either their own or another user's. The attacker copies a higher-privileged user's leaked API key and replays it against the Nagios XI API to perform actions beyond their assigned role. No public exploit code is identified, and successful exploitation depends on the Neptune theme being active.