CVE-2025-28131

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-28131
A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw arises due to improper authorization enforcement, enabling unauthorized modifications that compromise system integrity and availability.

4.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/harshal79/Privilege-Escalation-in-Nagios-Network-Analyzer.git Third Party Advisory
https://www.nagios.com/changelog/#network-analyzer Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:nagios:network_analyzer:2024:r1.0.3:*:*:*:*:*:*
History

11 Jul 2025, 13:39

Type Values Removed Values Added
References () https://github.com/harshal79/Privilege-Escalation-in-Nagios-Network-Analyzer.git - () https://github.com/harshal79/Privilege-Escalation-in-Nagios-Network-Analyzer.git - Third Party Advisory
References () https://www.nagios.com/changelog/#network-analyzer - () https://www.nagios.com/changelog/#network-analyzer - Release Notes
CPE cpe:2.3:a:nagios:network_analyzer:2024:r1.0.3:*:*:*:*:*:*
First Time Nagios
Nagios network Analyzer
Summary
  • (es) Una vulnerabilidad de control de acceso erróneo en Nagios Network Analyzer 2024R1.0.3 permite a usuarios con privilegios bajos y acceso de "Solo lectura" realizar acciones administrativas, como detener servicios del sistema y eliminar recursos críticos. Esta falla surge debido a una aplicación incorrecta de autorizaciones, lo que permite modificaciones no autorizadas que comprometen la integridad y la disponibilidad del sistema.

01 Apr 2025, 20:15

Type Values Removed Values Added
CWE CWE-285
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.6

01 Apr 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 17:15

Updated : 2025-07-11 13:39

NVD link : CVE-2025-28131

Mitre link : CVE-2025-28131

CVE.ORG link : CVE-2025-28131

JSON object : View

Products Affected

nagios

  • network_analyzer
CWE
CWE-285

Improper Authorization