A local privilege escalation vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts features are enabled. The configuration file nsclient.ini stores the administrative password in plaintext and is readable by all local users. An attacker can extract this password, authenticate to the NSClient++ web interface (usually on port 8443), and use the ExternalScripts plugin to register and trigger custom scripts. Once a script is registered and the configuration is saved, the attacker can execute the script via the API, causing arbitrary command execution with SYSTEM privileges. The flaw exemplifies insecure credential storage (CWE-522) and allows unchecked privilege escalation.

The vulnerability is present in the NSClient++ 0.5.2.35 product. No other product versions are identified as affected. The issue arises only when the web interface and ExternalScripts components are enabled in nsclient.ini.

The CVSS score of 7.3 classifies the vulnerability as high severity. The EPSS score of <1% indicates a very low probability of exploitation. The flaw is local; an attacker only needs to be able to read nsclient.ini, which is accessible to any local user. No remote network access is required. The exploit flow involves reading the plaintext password, logging into the web interface, registering a script via ExternalScripts, saving the configuration, and then triggering the script through the API to run commands as SYSTEM. The vulnerability is not listed in CISA's KEV catalog.