CyberSecBulletin

NSClient++ vulnerabilities

We track 2 vulnerabilities in NSClient++ products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 2, 2025.

2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score

Latest NSClient++ vulnerabilities

  • 7.8 High severity

    NSClient++: Improper Control of Generation of Code

    CVE-2025-34079NSClient++EPSS 1.7%

    An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interface (default port 8443

  • 7.8 High severity

    NSClient++: Insufficiently Protected Credentials

    CVE-2025-34078NSClient++

    A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file (nsclient.ini) stores the administrative password in plaintext and is readable by local users.