fkie_nvd - fkie_cve-2025-34135

FKIE_CVE-2025-34135

Vulnerability from fkie_nvd - Published: 2025-10-30 22:15 - Updated: 2025-11-06 18:16

Severity ?

4.4 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses.

References

URL	Tags
disclosure@vulncheck.com	https://www.nagios.com/changelog/nagios-xi/	Release Notes
disclosure@vulncheck.com	https://www.nagios.com/products/security/#nagios-xi	Vendor Advisory
disclosure@vulncheck.com	https://www.vulncheck.com/advisories/nagios-xi-overly-permissive-permissions-on-systemd-unit-files	Third Party Advisory

Impacted products

Vendor	Product	Version
nagios	nagios_xi	*
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024
nagios	nagios_xi	2024

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "62CF7BF4-6AAA-443E-93B4-B2F080091C13",
              "versionEndExcluding": "2024",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1:*:*:*:*:*:*",
              "matchCriteriaId": "85F1764D-1DD8-44B0-BF5A-2420CB519A3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.0.1:*:*:*:*:*:*",
              "matchCriteriaId": "C1FE1A0B-78D1-4626-A4CD-21B843DA596E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.0.2:*:*:*:*:*:*",
              "matchCriteriaId": "CCAB888E-F030-4640-9A18-9E423E553308",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1:*:*:*:*:*:*",
              "matchCriteriaId": "C648B0A4-053C-4884-8A37-4AF03053ED1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.1:*:*:*:*:*:*",
              "matchCriteriaId": "893EEA99-0096-4C9F-BA8A-246A3E3F6C15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.2:*:*:*:*:*:*",
              "matchCriteriaId": "A1FDA3F3-DF79-4807-9451-F04B2DB9A2B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.3:*:*:*:*:*:*",
              "matchCriteriaId": "9E055065-35A7-458A-A2DB-26634B97EE7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.4:*:*:*:*:*:*",
              "matchCriteriaId": "76946B2D-093C-4981-8465-5ADBB98C0676",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.1.5:*:*:*:*:*:*",
              "matchCriteriaId": "E9112876-7C61-4A72-8F91-023378E82E6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.2:*:*:*:*:*:*",
              "matchCriteriaId": "1443759F-EBD7-4366-A5D3-9FB15CE15B40",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.2.1:*:*:*:*:*:*",
              "matchCriteriaId": "F85D8CA4-F1AC-4538-925C-1AD00FF7B9C1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.2.2:*:*:*:*:*:*",
              "matchCriteriaId": "7FFC081E-728A-4643-A8DF-5CC8E94E7D78",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.3:*:*:*:*:*:*",
              "matchCriteriaId": "C3D8A858-2F40-4568-BCA0-59CF6033A7FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.3.1:*:*:*:*:*:*",
              "matchCriteriaId": "2D1C8647-F0EB-443F-B18B-338335CE54B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.3.2:*:*:*:*:*:*",
              "matchCriteriaId": "9A695A21-8F5A-4588-91E9-F7AF101B77AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.3.3:*:*:*:*:*:*",
              "matchCriteriaId": "AA587E9E-86DA-41A4-BF3B-56B1488B326A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.3.4:*:*:*:*:*:*",
              "matchCriteriaId": "BBCC6B6F-E627-49D4-9FA6-72283B07973A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.4:*:*:*:*:*:*",
              "matchCriteriaId": "450E4C8D-FC6B-42E6-A574-61F89AEB1800",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:r1.4.1:*:*:*:*:*:*",
              "matchCriteriaId": "838E2FEE-8707-4CA9-B877-EE69D32615E2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nagios XI versions prior to\u00a02024R1.4.2\u00a0configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses."
    }
  ],
  "id": "CVE-2025-34135",
  "lastModified": "2025-11-06T18:16:51.890",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-10-30T22:15:47.120",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://www.nagios.com/changelog/nagios-xi/"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.nagios.com/products/security/#nagios-xi"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.vulncheck.com/advisories/nagios-xi-overly-permissive-permissions-on-systemd-unit-files"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

CVE-2025-34135 (GCVE-0-2025-34135)

Vulnerability from cvelistv5 – Published: 2025-10-30 21:39 – Updated: 2025-11-17 18:21

Summary

Severity ?

5.1 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

VulnCheck

References

URL

Tags

	https://www.nagios.com/products/security/#nagios-xi	vendor-advisorypatch
	https://www.nagios.com/changelog/nagios-xi/	release-notespatch
	https://www.vulncheck.com/advisories/nagios-xi-ov…	third-party-advisory

Impacted products

	Vendor	Product	Version
	Nagios	XI	Unknown: 0 , < 2024R1.4.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34135",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-31T13:45:15.619589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-31T13:56:12.807Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "systemd unit files (including nagios.service)"
          ],
          "product": "XI",
          "vendor": "Nagios",
          "versions": [
            {
              "lessThan": "2024R1.4.2",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nagios:nagios_xi:2024:*:*:*:*:*:*:*",
                  "versionEndExcluding": "r1.4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Nagios XI versions prior to\u0026nbsp;2024R1.4.2\u0026nbsp;configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses.\u003cbr\u003e"
            }
          ],
          "value": "Nagios XI versions prior to\u00a02024R1.4.2\u00a0configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-17T18:21:50.638Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.nagios.com/products/security/#nagios-xi"
        },
        {
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://www.nagios.com/changelog/nagios-xi/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nagios-xi-overly-permissive-permissions-on-systemd-unit-files"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNagios addresses this vulnerability as \"\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNagios XI had some Systemd unit files with permission sets that were too permissive\" and \"Fixed a permissions insecurity for nagios.service (removed execute permissions).\"\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Nagios addresses this vulnerability as \"Nagios XI had some Systemd unit files with permission sets that were too permissive\" and \"Fixed a permissions insecurity for nagios.service (removed execute permissions).\""
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Nagios XI \u003c 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34135",
    "datePublished": "2025-10-30T21:39:22.649Z",
    "dateReserved": "2025-04-15T19:15:22.562Z",
    "dateUpdated": "2025-11-17T18:21:50.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2025-34135

CVE-2025-34135 (GCVE-0-2025-34135)

Tags

Sightings

Nomenclature