CVE-2025-44824

Description

Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response. This is GL:NLS#474.

PUBLISHED Reserved 2025-04-22 | Published 2025-10-07 | Updated 2025-10-08 | Assigner mitre

Problem types

CWE-863 Incorrect Authorization

Product status

References

github.com/skraft9/nagios-log-server-dos exploit

www.nagios.com/changelog/

github.com/skraft9/nagios-log-server-dos

cve.org (CVE-2025-44824)

nvd.nist.gov (CVE-2025-44824)

Download JSON