CVE-2025-34271
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise.
| Software | From | Fixed in |
|---|---|---|
| nagios / log_server | - | 2024 |
| nagios / log_server | 2024-r1 | 2024-r1.x |
| nagios / log_server | 2024-r1.0.1 | 2024-r1.0.1.x |
| nagios / log_server | 2024-r1.0.2 | 2024-r1.0.2.x |
| nagios / log_server | 2024-r1.1 | 2024-r1.1.x |
| nagios / log_server | 2024-r1.2 | 2024-r1.2.x |
| nagios / log_server | 2024-r1.3 | 2024-r1.3.x |
| nagios / log_server | 2024-r1.3.1 | 2024-r1.3.1.x |
| nagios / log_server | 2024-r1.3.2 | 2024-r1.3.2.x |
| nagios / log_server | 2024-r1.3.3 | 2024-r1.3.3.x |
| nagios / log_server | 2024-r1.3.4 | 2024-r1.3.4.x |
| nagios / log_server | 2024-r1.3.5 | 2024-r1.3.5.x |
| nagios / log_server | 2024-r2 | 2024-r2.x |
| nagios / log_server | 2024-r2.0.1 | 2024-r2.0.1.x |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime