Nagios Log Server CVE-2025-34298

Attacker must hold a valid authenticated account on the Nagios Log Server instance (PR:L) and reach the per-user account email-change workflow; exploitation is triggered specifically by setting the account email to an invalid value, which the application fails to validate and uses to derive authorization state. LIMITING FACTORS: requires pre-existing authenticated (even if low-privileged) access, so it is not exploitable by fully unauthenticated outsiders; affected instances are those running Nagios Log Server versions prior to 2024R1.3.2 (2024 R1 through R1.3.1 per the CPE list); no special non-default configuration or user interaction from a victim is needed. No confirmed evidence of a prerequisite beyond authenticated access and access to the email-change feature.

This is a credible, above-average-priority issue but not a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, SC/SI/SA:N) scores 8.7 (High) and is internally consistent with the description: a network-reachable, low-complexity attack requiring only existing low-level authenticated access (PR:L), no user interaction, yielding full confidentiality/integrity/availability impact on the vulnerable system via privilege escalation - matching CWE-281 (improper preservation of permissions). The key tempering signals: exploitation requires an already-authenticated account (PR:L), so this is a privilege-escalation primitive for an insider or a foothold attacker, not a pre-auth remote takeover. On the exploitation-likelihood side there is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data - meaning no public exploit identified at time of analysis and no evidence of active exploitation. SSVC framing: exploitation status 'none observed', technical impact 'total' (full control of the Log Server), automatability likely 'no' because it needs a valid authenticated session per target. MISSING DATA: EPSS, KEV, and POC status are all absent from the input and cannot be inferred; the CVSS vector is vendor/VulnCheck-supplied (not independently confirmed by NVD as a reviewed score). Net: treat as a high-value escalation bug to patch promptly in any multi-user Nagios Log Server deployment, but real-world urgency is moderated by the authentication precondition and absence of known exploitation.

A low-privileged but authenticated Nagios Log Server user navigates to their own account settings and submits an invalid email value through the email-change workflow. Because validation and authorization checks are tied to email-identity state, the account is left in an inconsistent state that the application interprets as holding elevated privileges, letting the user bypass intended access controls and gain administrative capabilities. No public exploit code is identified at time of analysis, so this would currently require an attacker to independently reproduce the email-state manipulation.