What’s Vulnerable › Vulnerabilities

CVE-2025-34270: Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-30 · updated 2026-10-07
• Weakness: CWE-312

Description

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.

Affected products

• Nagios Log Server: before 2024; 2024-r1, 2024-r1.0.1, 2024-r1.0.2, 2024-r1.1, 2024-r1.2, 2024-r1.3 (+7) — fixed in 2024

How to fix

Upgrade to a fixed version: Nagios Log Server 2024. Check the vendor advisory for mitigations.

References

• https://support.nagios.com/kb/article/authenticating-and-importing-users-with-ad-and-ldap-995.html
• https://www.nagios.com/changelog/#log-server
• https://www.nagios.com/products/security/#log-server-2024R2
• https://www.vulncheck.com/advisories/nagios-log-server-ad-ldap-import-password-not-obfuscated

Get alerted when CVE-2025-34270 or the next vulnerability affects your stack