CVE-2025-34287: Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl
Nagios XI versions prior to 2024R2 contain an improperly owned script, processperfdata.pl, which is executed periodically as the nagios user but owned by www-data. Because the file was writable by www-data, an attacker with web server privileges could modify its contents, leading to arbitrary code execution as the nagios user when the script is next run. This improper ownership and permission configuration enables local privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios XIto a version that resolves this vulnerability.Fixed in 2024R2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34287?
CVE-2025-34287 is considered a critical vulnerability due to its potential for privilege escalation and unauthorized access.
How do I fix CVE-2025-34287?
To fix CVE-2025-34287, ensure that the process_perfdata.pl script is properly owned and only writable by the nagios user.
What systems are affected by CVE-2025-34287?
CVE-2025-34287 affects all versions of Nagios XI prior to 2024R2.
What is process_perfdata.pl in the context of CVE-2025-34287?
Process_perfdata.pl is a Nagios script that, if improperly owned, can allow attackers with web server access to modify its contents.
Can an attacker exploit CVE-2025-34287 remotely?
Yes, an attacker with web server privileges can exploit CVE-2025-34287 remotely by modifying the vulnerable script.