Cyber Resilience

CVE-2025-28131

Medium

Published: 01 April 2025

Published
01 April 2025
Modified
11 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 4.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS Score 0.0034 57.2th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28131 is a medium-severity Improper Authorization (CWE-285) vulnerability in Nagios Network Analyzer. Its CVSS base score is 4.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 42.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw arises due to improper authorization enforcement, enabling unauthorized modifications that…

more

compromise system integrity and availability.

CWE(s)
CWE-285

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1489 Service Stop Impact
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
attack.mitre.org →
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
attack.mitre.org →
T1685 Disable or Modify Tools Defense Impairment
Adversaries may disable, degrade, or tamper with security tools or applications (e.
attack.mitre.org →
Why these techniques?

Broken access control enables low-privilege users to exploit for privilege escalation (T1068), stop system services (T1489), delete critical resources causing data destruction (T1485), and disable monitoring tools (T1562.001).

Affected Assets

nagios
network analyzer
2024

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-285

Documented procedures facilitate correct implementation and ongoing management of authorization decisions.

AC-13 Supervision and Review — Access Control
addresses: CWE-285

Periodic reviews identify and correct flaws in authorization decisions or enforcement.

AC-14 Permitted Actions Without Identification or Authentication
addresses: CWE-285

The control's documentation requirement reduces improper authorization by ensuring only mission-justified actions bypass authentication.

AC-16 Security and Privacy Attributes
addresses: CWE-285

Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.

AC-17 Remote Access
addresses: CWE-285

Explicitly mandates authorizing remote access types before permitting connections, directly mitigating improper authorization.

AC-18 Wireless Access
addresses: CWE-285

The control explicitly requires authorization of each wireless access type prior to permitting connections.

AC-19 Access Control for Mobile Devices
addresses: CWE-285

Mandating explicit authorization of mobile device connections reduces the risk of improper authorization decisions for system access.

AC-2 Account Management
addresses: CWE-285

Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.

References