Nagios Log Server CVE-2025-44824

Exploitation requires a valid authenticated session with at least read-only API access to Nagios Log Server versions prior to 2024R1.3.2; the attacker then invokes the system stop endpoint /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch, which improperly authorizes the read-only role to stop the Elasticsearch subsystem. Limiting factors: the attacker must possess or obtain working credentials (no fully unauthenticated path), and the API endpoint must be network-reachable; impact is confined to availability of the Elasticsearch-backed logging/search service, with no data disclosure or modification. A notable detection caveat is that the API falsely returns 'Could not stop elasticsearch' even when the service is successfully stopped.

This is a moderate, availability-only issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: a network-reachable, low-complexity action that requires authentication (PR:L - a user holding read-only API access) and yields a pure availability impact (stopping the Elasticsearch backend) with no confidentiality or integrity loss. CWE-863 (improper authorization) matches the core defect - a read-only principal is permitted a state-changing administrative action it should not have. Signals partially reinforce each other and partially temper the risk: POC exploit code is publicly available (skraft9/nagios-log-server-dos), which raises practical exploitability, and EPSS is elevated for a non-KEV flaw (2.77%, 86th percentile). However, this is NOT on the CISA KEV list, so there is no evidence of active real-world exploitation despite the available POC - POC availability and active exploitation are distinct signals and should not be conflated. The requirement for valid authentication (even if only read-only) meaningfully limits the attacker population to insiders or anyone who has already obtained a low-privilege credential, and the impact ceiling is a denial of the logging/search service, not data theft or RCE. Net: a legitimate patch-soon issue for Nagios Log Server operators (especially given the authorization bypass is trivial once authenticated), but not a drop-everything critical.

An attacker who already holds a low-privilege, read-only API account (or has phished/stolen such a credential) sends a single crafted GET to /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch and halts the Elasticsearch backend, blanking log ingestion and search for all users. A public POC (skraft9/nagios-log-server-dos) automates this, and because the action succeeds even though the API returns 'Could not stop elasticsearch', defenders may be misled about whether the stop occurred.