CVE-2025-44824

Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2024R1.3.2

Description Nagios Log Server versions prior to 2024R1.3.2 allow authenticated users with read-only API access to stop the Elasticsearch service. This is achieved by sending a request to the /nagioslogserver/index.php/api/system/stop API endpoint with the subsystem parameter set to elasticsearch. Despite the API response indicating a failure to stop the service ("message": "Could not stop elasticsearch"), the Elasticsearch service is stopped.

Recommendations Update Nagios Log Server to version 2024R1.3.2 or later.