PT-2025-17319 · Nagios · Nagios Network Analyzer

Published 2025-04-18 · Updated 2025-09-14 · CVE-2025-28059

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nagios Network Analyzer version 2024R1.0.3

Description The issue arises from improper session invalidation and stale token handling, allowing deleted users to retain access to system resources. When a user account is deleted by an administrator, the backend fails to terminate active sessions and revoke associated API tokens, thus enabling unauthorized access to restricted functions.

Recommendations For Nagios Network Analyzer version 2024R1.0.3, consider manually terminating all active sessions and revoking associated API tokens when a user account is deleted to prevent unauthorized access until a patch is available. As a temporary workaround, restrict access to sensitive functions and resources to minimize the risk of exploitation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-28059

Affected Products

Nagios Network Analyzer

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-28059 · Security Note
• https://osv.dev/vulnerability/CVE-2025-28059 · Vendor Advisory
• https://t.me/cvenotify/128537 · Telegram Post
• https://github.com/aakashtyal/Residual-Data-Access-Post-User-Deletion-in-Nagios-Network-Analyzer-Version-2024R1 · Note
• https://t.me/cvetracker/21940 · Telegram Post
• https://nagios.com/changelog/#network-analyze · Note
• https://twitter.com/CVEnew/status/1913312986221187131 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/1967301345750503637 · Twitter Post
• https://t.me/cvedetector/23340 · Telegram Post