What’s Vulnerable › Vulnerabilities

CVE-2025-34273: Nagios Log Server < 2024R2.0.3 Non-Admin Dashboard Deletion

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-30 · updated 2026-10-07
• Weakness: CWE-863

Description

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged users to remove dashboards that affect other users or the overall monitoring UI.

Affected products

• Nagios Log Server: before 2024; 2024-r1, 2024-r1.0.1, 2024-r1.0.2, 2024-r1.1, 2024-r1.2, 2024-r1.3 (+8) — fixed in 2024

How to fix

Upgrade to a fixed version: Nagios Log Server 2024. Check the vendor advisory for mitigations.

References

• https://www.nagios.com/changelog/#log-server
• https://www.nagios.com/products/security/#log-server-2024R2
• https://www.vulncheck.com/advisories/nagios-log-server-non-admin-dashboard-deletion

Get alerted when CVE-2025-34273 or the next vulnerability affects your stack