CVE-2025-60425

Description

Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.

CVSS v3.1 Score

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Weakness Type (CWE)

CWE-491 CWE-491

Affected Products

Vendor	Product	Versions
nagios	fusion	All
nagios	fusion	All

References

Other References

https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA-CVE-2025-60425 https://www.nagios.com/changelog/#fusion

Frequently Asked Questions

What is CVE-2025-60425? +

Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack. It has a CVSS v3.1 base score of 8.6 (HIGH).

How severe is CVE-2025-60425? +

CVE-2025-60425 has a CVSS v3.1 score of 8.6 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-60425? +

CVE-2025-60425 affects products from nagios, specifically: fusion. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-60425? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-63685 9.8

Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, …

CVE-2024-39069 7.8

An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hijacking …

CVE-2025-55622 6.5

Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings. NOTE: this is disputed by …

CVE-2025-44823 9.9

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is …

CVE-2024-24401 9.8

SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to …

CVE-2024-24402 9.8

An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd …