CVE-2025-44823

VendornagiosProductlog serverDiscoveredOct 7, 2025UpdatedNov 6, 2025

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.

View graph Watch Export

CVSS v3.1

9.9 CRITICAL

EPSS

16.9%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Oct 28, 2026

▲ 1.31pp

15.6% → 16.9% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Connections

3 relationships

CWE-497

source

Timeline

disclosure → media coverage

Oct 7, 2025

Disclosure — published as a CVE record. · last revised by NVD Nov 6, 2025

Oct 9, 2025

acn.gov.it reports: Nagios Log Server: PoC pubblici per lo sfruttamento delle CVE-2025-44823 e CVE-2025-44824

Public PoC (1)

github.com/skraft9/CVE-2025-44823

Unverified third-party code — review before executing.