CVE-2025-34078

CVE-2025-34078 is a local privilege escalation vulnerability affecting NSClient++ version 0.5.2.35 when its web interface and ExternalScripts features are enabled. The vulnerability stems from the plaintext storage of the administrative password in the nsclient.ini file, which is readable by local users. This allows an attacker to obtain credentials, authenticate to the web interface, and execute arbitrary commands as SYSTEM through the ExternalScripts plugin. This vulnerability is rated as HIGH severity with a CVSS score of 7.8, indicating a low attack complexity and requiring only local user privileges to achieve high impact on confidentiality, integrity, and availability. While not currently on the KEV list or showing active exploitation, a Metasploit module exists, demonstrating readily available exploit code. Community discussion and media coverage are minimal, which is typical for the majority of CVEs.