What is the CVSS score of CVE-2025-44823?

CVE-2025-44823 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 16.1%.

Which versions of Nagios Log Server are affected by CVE-2025-44823?

Nagios Log Server versions prior to 2024R1.3.2 expose administrative API keys, potentially allowing attackers to gain administrative control over the log server and access sensitive log data.

Is there a public PoC exploit available for CVE-2025-44823?

Yes, a public proof-of-concept exploit is available for CVE-2025-44823. Prioritise patching immediately. EPSS: 16.1%.

How to fix or mitigate CVE-2025-44823?

Within 24 hours, identify all Nagios Log Server instances running versions prior to 2024R1.3.2, restrict network access to the administrative interface and the /nagioslogserver/index.php/api/system/get_users endpoint to trusted IPs only, rotate all administrative API keys, and review logs for unauthorized access attempts. Within 7 days, enforce least privilege by disabling or limiting low-privileged accounts that do not require access, implement monitoring and alerting for requests to the vulnerable endpoint, deploy WAF rules to block or alert on suspicious API calls, and ensure all API keys are stored securely and not exposed in cleartext. Within 30 days, apply the vendor patch as soon as it becomes available or upgrade to a fixed version if confirmed (e.g., 2024R1.3.2 or later), conduct a full audit of API key usage and account permissions, and consider network segmentation or additional access controls for the log server environment.

Nagios Log Server CVE-2025-44823

HIGH

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2025-10-07 cve@mitre.org

PHP Information Disclosure Log Server Nagios

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Authenticated low-priv user over the network (PR:L, AV:N, AC:L) reads admin keys; direct impact is confidentiality only (C:H), so I:N/A:N - integrity/availability loss is a downstream consequence of key reuse, not this base flaw.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 13:40 vuln.today

tag: Nagios added

Analysis Generated

Oct 08, 2026 - 13:31 vuln.today

CVE Published

Oct 07, 2025 - 20:15 nvd

HIGH 8.8

DescriptionNVD

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.

AnalysisAI

Cleartext exposure of administrative API keys in Nagios Log Server versions prior to 2024R1.3.2 allows authenticated low-privileged users to retrieve sensitive credentials via the /nagioslogserver/index.php/api/system/get_users endpoint. Publicly available exploit code exists (Exploit-DB 52177), though active exploitation has not been confirmed. The flaw requires only a valid low-privileged account and no user interaction, and successful retrieval can provide attackers with keys that grant administrative access to the log server's API.

Technical ContextAI

Nagios Log Server is a PHP-based log management and analysis application. The vulnerability resides in the web API endpoint /nagioslogserver/index.php/api/system/get_users, which improperly returns administrative API keys in cleartext to any authenticated user, regardless of privilege level. This violates CWE-497, the exposure of sensitive system information to an unauthorized control sphere. The assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms a network-reachable, low-complexity attack requiring low privileges with no user interaction, and an impact limited to confidentiality. Affected versions include all releases from 2024R1 up to and including 2024R1.3.1, as identified by CPE strings such as cpe:2.3:a:nagios:log_server:2024:r1 and cpe:2.3:a:nagios:log_server:2024:r1.3.1. The underlying cause is a failure to restrict access to sensitive API key data based on user role.

RemediationAI

Upgrade to Nagios Log Server 2024R1.3.2 or later, which resolves the cleartext API key exposure. The vendor changelog (https://www.nagios.com/changelog/#log-server) provides the official patch. If immediate upgrade is not possible, restrict access to the /nagioslogserver/index.php/api/system/get_users endpoint to trusted administrative users only, and ensure that low-privileged accounts are not created unnecessarily. However, these compensating controls are not a substitute for the patch and may impact legitimate API functionality. Additionally, rotate any administrative API keys that may have been exposed, as they remain valid until changed.