A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack.
References
| Link | Resource |
|---|---|
| https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack | Mitigation Third Party Advisory |
| https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424 | Mitigation Third Party Advisory |
| https://www.nagios.com/changelog/#fusion | Release Notes |
Configurations
Configuration 1 (hide)
|
History
05 Nov 2025, 21:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nagios:fusion:2024:r2.1:*:*:*:*:*:* cpe:2.3:a:nagios:fusion:2024:r1.2:*:*:*:*:*:* |
|
| First Time |
Nagios
Nagios fusion |
|
| References | () https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack - Mitigation, Third Party Advisory | |
| References | () https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424 - Mitigation, Third Party Advisory | |
| References | () https://www.nagios.com/changelog/#fusion - Release Notes |
27 Oct 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-27 16:15
Updated : 2025-11-05 21:00
NVD link : CVE-2025-60424
Mitre link : CVE-2025-60424
CVE.ORG link : CVE-2025-60424
JSON object : View
Products Affected
nagios
- fusion