CVE-2025-60424

moderate-risk
Published 2025-10-27

A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack.

Do I need to act?

-
0.11% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.6/10 High
ADJACENT_NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Nagios

References (3)

Mitigation https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack
Mitigation https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-604...
Release Notes https://www.nagios.com/changelog/#fusion
31
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 0/34 · Minimal
Exposure 7/34 · Low