Vulnerability Report

CVE-2025-60424

Title: Nagios Fusion Auth Bypass

Auth Bypass

Proof Of Concept

PoC Available for CVE-2025-60424

CWE Category CWE-287
Published Date Oct 27, 2025
Modified Date Nov 05, 2025
Exploit Status Available
Score 7.6 CVSS v3.1
Exploit Probability (EPSS)
0.67%

Vulnerability Summary

CVE-2025-60424: A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack.

Impacted Vendors

V
vmware 1
F
fusiondrupalthemes 1
D
digitalnature 1
N
nagios 1

Reference Links

https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424 https://www.nagios.com/changelog/#fusion
CVSS v3.1
Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0
Severity HIGH
7.6
Attack Vector
ADJACENT_NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2025-60424 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424
View Code
MODIFIED

Vulnerability data or affected products updated.

MODIFIED

Vulnerability data updated via NVD.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector ADJACENT_NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected Stack

No specific products linked.