CVE-2025-34079
📋 TL;DR
This vulnerability allows authenticated attackers with administrator credentials to execute arbitrary commands with SYSTEM privileges on NSClient++ servers. It affects NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. Attackers can inject malicious commands through the web API and trigger them remotely.
💻 Affected Systems
- NSClient++
📦 What is this software?
Nsclient\+\+ by Nsclient
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling data theft, lateral movement, ransomware deployment, and persistent backdoor installation.
Likely Case
Attackers with stolen or default admin credentials gain full control over the monitoring server, potentially compromising the entire monitoring infrastructure.
If Mitigated
Limited to authorized administrators performing legitimate script execution with proper audit trails.
🎯 Exploit Status
Metasploit module available. Requires admin credentials. Exploitation is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch exists. This is a design flaw in the intended functionality. Apply workarounds and security controls instead.
🔧 Temporary Workarounds
Disable web interface
windowsDisable the web interface if not required for operations
Edit nsclient.ini: set [/settings/NSClient/server] enabled = false
Restart NSClient++ service
Disable ExternalScripts module
windowsDisable the ExternalScripts module to prevent command injection
Edit nsclient.ini: set [/settings/external scripts] enabled = false
Restart NSClient++ service
Restrict web interface access
windowsConfigure firewall rules to restrict access to web interface port
netsh advfirewall firewall add rule name="Block NSClient Web" dir=in action=block protocol=TCP localport=8443
Or restrict to specific management IPs
🧯 If You Can't Patch
- Change default admin password to strong, unique credentials
- Implement network segmentation to isolate NSClient++ servers from critical systems
🔍 How to Verify
Check if Vulnerable:
Check if version is 0.5.2.35 and both web interface and ExternalScripts module are enabled in nsclient.iniCheck Version:
nscp client --versionVerify Fix Applied:
Verify web interface is disabled or ExternalScripts module is disabled in configuration📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to /settings/query.json or /query/{name} endpoints
- Multiple failed authentication attempts followed by successful login
- External script execution logs with unusual commands
Network Indicators:
- HTTP POST requests to port 8443 with command injection patterns
- Outbound connections from NSClient++ server to unexpected destinations
SIEM Query:
source="nsclient.log" AND (uri="/settings/query.json" OR uri="/query/*") AND (command="cmd.exe" OR command="powershell.exe")