CVE-2025-34135

Katalog CVE

CVSS 4.4 · Medium EPSS 0,36%

Kerentanan Incorrect Permission Assignment for Critical Resource pada nagios xi. Skor CVSS 3.1 4.4 (Medium) menurut NVD.

Deskripsi (NVD)

Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses.

Rincian

Terbit di NVD

30 Oktober 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.nagios.com/products/security/#nagios-xi advisory vendor
• https://www.vulncheck.com/advisories/nagios-xi-overly-permissive-permissions-on-systemd-unit-files advisory pihak ketiga
• https://www.nagios.com/changelog/nagios-xi/ release notes