Nagios XI CVE-2025-34287

Requires the attacker to already hold www-data (web server) privileges on the Nagios XI host, because process_perfdata.pl is owned by and writable by www-data while being executed periodically by the nagios user. The specific prerequisite is a prior web-tier foothold (e.g. an existing web application compromise or local shell as www-data); there is no remote or unauthenticated path. Exploitation is limited to Nagios XI versions prior to 2024R2 and depends on the scheduler actually invoking the script, which occurs during normal performance-data processing. This is strictly a local privilege-escalation condition, not remotely reachable on its own.

This is a genuine but conditional privilege-escalation issue, not a critical internet-facing threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms LOCAL attack vector with low complexity and LOW privileges required - the attacker must already possess www-data (web server) privileges on the host before this flaw is useful. The score of 8.4 is driven by high confidentiality/integrity impact (VC:H/VI:H) from gaining the nagios service account, with low availability impact (VA:L). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or widespread exploitation - this is a post-compromise escalation primitive rather than an initial-access vulnerability. The practical priority is moderate: it meaningfully worsens any existing web-tier compromise of a Nagios XI server, but it cannot be triggered by a remote unauthenticated attacker on its own. CWE-732 (incorrect permission assignment) is consistent with the description of a www-data-writable script executed as the nagios user.

An attacker who has already compromised the Nagios XI web application (gaining www-data execution, e.g. via a separate web vulnerability or webshell) overwrites the www-data-writable process_perfdata.pl script with malicious Perl code. When the Nagios scheduler next runs the script as the nagios user, the attacker's code executes with nagios privileges, escalating from the web tier to the monitoring service account. No public exploit code was identified at time of analysis.