CVE-2025-34280: Nagios Network Analyzer < 2024R2.0.1 RCE in LDAP Certificate Removal Function
Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command execution on the underlying host in the context of the web application service, resulting in remote code execution with the service's privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios Network Analyzerto a version that resolves this vulnerability.Fixed in 2024R2.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34280?
CVE-2025-34280 has been classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-34280?
To fix CVE-2025-34280, upgrade to Nagios Network Analyzer version 2024R2.0.1 or later.
Who is affected by CVE-2025-34280?
CVE-2025-34280 affects all versions of Nagios Network Analyzer prior to 2024R2.0.1.
What type of vulnerability is CVE-2025-34280?
CVE-2025-34280 is a command execution vulnerability resulting from inadequate input sanitation in LDAP certificate management.
Can CVE-2025-34280 be exploited remotely?
Yes, an authenticated administrator could exploit CVE-2025-34280 to execute commands remotely.