CVE-2025-44823

CVSS 9.9 CRITICALEPSS 15.6%CWE-497

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Nagios · Log Server

public PoCs found — 2

githubgithub.com/skraft9/CVE-2025-44823★ 0 cve_referencewww.exploit-db.com/exploits/52177unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.exploit-db.com/exploits/52177 https://www.nagios.com/changelog/#log-server