CVE-2025-34078
Published: 02 July 2025
Summary
CVE-2025-34078 is a high-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Nsclient Nsclient\+\+. Its CVSS base score is 7.3 (High).
Operationally, ranked in the top 8.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A local privilege escalation vulnerability affects NSClient++ version 0.5.2.35 when the web interface and ExternalScripts features are both enabled. The nsclient.ini configuration file stores the administrative password in plaintext and grants local users read access to it, allowing any local account to retrieve the credential and reach administrative functions that should otherwise be isolated.
An attacker with an existing local user session can extract the password, authenticate to the web interface listening on TCP port 8443, register a malicious script through the ExternalScripts plugin, persist the change, and invoke the script via the API to obtain code execution as SYSTEM. The issue stems from documented but insecure design choices that expose credentials and administrative APIs to all local users.
Public exploit code is available, including a Metasploit module and multiple entries on Exploit-DB, indicating that working proof-of-concept implementations have been published. The EPSS score has remained flat at 0.0705 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19753
Vulnerability details
A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file (nsclient.ini) stores the administrative password in plaintext and is readable by local users. By extracting this password, an…
more
attacker can authenticate to the NSClient++ web interface (typically accessible on port 8443) and abuse the ExternalScripts plugin to inject and execute arbitrary commands as SYSTEM by registering a custom script, saving the configuration, and triggering it via the API. This behavior is documented but insecure, as the plaintext credential exposure undermines access isolation between local users and administrative functions.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Training instructs users on protecting credentials from disclosure or unauthorized access.
Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.
Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.
Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.
Terminating or revoking credentials stops use of insufficiently protected or lingering credentials post-termination.
Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.
Credentials or keys delivered out-of-band are not exposed to interception or inadequate protection on the main transport.