Nagios Fusion
CVE-2025-60424
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid first-factor credentials
-
DeliveryReach OTP verification endpoint
-
ExploitSubmit automated OTP guesses without rate limit
-
ExecutionBrute-force correct one-time code
-
ImpactComplete authentication and access Fusion account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess valid first-factor credentials (username and password) for a Nagios Fusion account and for OTP/two-factor verification to be enabled, since the flaw is in the OTP verification step. The specific prerequisite is that this OTP verification component enforces no rate limiting, allowing unlimited sequential code guesses until the correct one is found. Limiting factors: it affects only versions 2024R1.2 and 2024R2.1; it requires the first authentication factor (PR:L), so a fully anonymous attacker cannot reach the vulnerable step; and the input CVSS marks the vector as adjacent (AV:A), which would constrain exploitation to attackers with network adjacency unless the Fusion login interface is internet-exposed. |
| Impact | Signals point to a moderate, prioritize-this-week issue rather than a drop-everything emergency. The CVSS 3.1 base score of 7.6 (High) reflects high confidentiality and integrity impact (C:H/I:H) from a full authentication bypass, but exploitation is gated by PR:L - the attacker must already hold valid first-factor credentials - and the input vector lists AV:A (adjacent network), which limits remote reach. EPSS is low at 0.71% (53rd percentile), and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation; this aligns with the vuln.today 'this_week' decision label rather than act_now/emergency. Two GitHub references describe a 2FA brute-force PoC for this exact CVE ID, so this is not a theoretical-only flaw, but those references are not verified as working exploit code. One conflict to verify with the vendor: the supplied CVSS vector uses AV:A (adjacent), yet an OTP verification endpoint on a web application is typically network-reachable - if the login/OTP interface is internet-exposed, real-world attack surface is larger than AV:A implies. Net: a genuine authentication-bypass weakness worth remediating promptly, but the first-factor-credential prerequisite and low EPSS keep it below critical-urgency. |
| Exploit ScenarioDerived | An attacker who already holds (or has phished/guessed) a valid Nagios Fusion username and password reaches the OTP second-factor prompt, then submits automated guesses against the OTP verification endpoint. Because that endpoint enforces no rate limiting, the attacker brute-forces the one-time code and completes login, fully bypassing the 2FA protection. Public PoC references for this CVE exist on GitHub but are not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
The OTP verification step in Nagios Fusion 2024R1.2 and 2024R2.1 accepts an unlimited number of code guesses, so an attacker who already holds a valid username and password for a Fusion account can brute-force the one-time code and complete authentication without ever possessing the second factor. Because the flaw sits after the first authentication factor, a fully anonymous attacker cannot reach the vulnerable component; the input vector is scored adjacent-network (AV:A) while our independent assessment treats it as network-reachable (AV:N), so real exposure depends on whether the Fusion login interface is internet-facing. No CISA KEV entry exists, a public PoC reference is published on GitHub but is not verified as working exploit code, and EPSS is 0.71% (53rd percentile), which supports a prioritize-this-week rather than emergency posture.
RemediationAI
No exact fixed version is stated in the supplied data; the authoritative source is the Nagios Fusion changelog at https://www.nagios.com/changelog/#fusion, which should be reviewed and the installation upgraded to the first release listed there after 2024R2.1, with the VulDB entry at https://vuldb.com/vuln/330147 as a secondary reference. Until a fixed build is running, note that the attack path is unreachable without valid first-factor credentials, so practical exposure tracks directly to how many Fusion accounts exist with OTP enabled and whether the Fusion login interface is reachable from untrusted networks - an exposure decision already relevant because the input vector is adjacent (AV:A) while our assessment scores it network (AV:N). Where the interface is internet-exposed, the deployment's own network access policy for the Fusion login endpoint is the control that determines reachability; the vendor changelog should be consulted for any statement on compensating controls, as no such guidance is present in the available data.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Nagios Fusion is the central monitoring console that aggregates Nagios XI and Core servers. CWE-287 (Improper Authentication) is the assigned root-cause class, and the specific defect is the absence of throttling, lockout or backoff on the OTP verification component, meaning submitted codes are validated without any counter or delay. The underlying primitive is therefore an online guessing attack against a short numeric secret, whose success probability scales with the number of requests the endpoint will accept. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) reflects that the attacker must first authenticate with valid first-factor credentials (PR:L) and that OTP/two-factor verification must be enabled for the targeted account for the vulnerable code path to be exercised at all. The input vector differs only in AV:A, which would restrict reachability to adjacent networks; that discrepancy is unresolved in the supplied data and should be treated as deployment-dependent. Scope is unchanged, and the low availability impact reflects the possibility of account lockout or service disruption during sustained guessing, not a distinct availability flaw. The trigger beyond 'unlimited guesses against the OTP check' is not further described in the available sources.
Know when Nagios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
OTP web endpoint is network-reachable (AV:N, diverging from input AV:A); valid first factor needed so PR:L; unthrottled brute-force is reliable (AC:L); account takeover gives C:H/I:H, limited A.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack.
Executive ViewAI
Nagios Fusion versions 2024R1.2 and 2024R2.1 contain a high-severity flaw that undermines multi-factor authentication, allowing anyone who has already obtained a valid username and password to bypass the second factor via unlimited OTP guesses. This effectively negates MFA protections and increases the risk of unauthorized access to critical monitoring infrastructure. Leadership should prioritize remediation because compromised accounts could lead to operational disruptions or broader network compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the Fusion login interface, enforcing strong password policies, and monitoring for brute-force attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote att
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerabili
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10
MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP r
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post au
Exploit-DB