CVE-2025-34135: Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files
Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios XIto a version that resolves this vulnerability.Fixed in 2024R1.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34135?
CVE-2025-34135 is considered a high-severity vulnerability due to its potential to allow local attackers to escalate privileges.
How do I fix CVE-2025-34135?
To fix CVE-2025-34135, update Nagios XI to version 2024R1.4.2 or later to ensure proper permissions are set on systemd unit files.
What versions of Nagios XI are affected by CVE-2025-34135?
CVE-2025-34135 affects Nagios XI versions prior to 2024R1.4.2.
What type of permissions are involved in CVE-2025-34135?
CVE-2025-34135 involves overly permissive executable permissions on the nagios.service systemd unit file.
What are the potential risks associated with CVE-2025-34135?
The risks associated with CVE-2025-34135 include the possibility for local users to gain unauthorized access and escalate privileges on the system.