PT-2025-44461 · Unknown · Nagios Fusion

Published 2025-10-30 · Updated 2025-10-31 · CVE-2025-34249

Positive Technologies · (AI Summary)

CVSS v4.0

10

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nagios Fusion versions prior to 2024R2.1

Description The application lacks proper rate limiting or account lockout mechanisms for repeated failed Two-Factor Authentication (2FA) verification attempts. This allows a remote attacker to repeatedly guess second-factor codes for a targeted account. By exploiting this deficiency, an attacker could potentially bypass 2FA and successfully authenticate to accounts protected by it.

Recommendations Update to version 2024R2.1 or later.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2025-15971

CVE-2025-34249

Affected Products

Nagios Fusion

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-34249 · Security Note
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://nagios.com/changelog/nagios-fusion · Patch
• https://bdu.fstec.ru/vul/2025-15971 · Security Note
• https://twitter.com/0dayPublishing/status/1984008548087456122 · Twitter Post
• https://twitter.com/CVEnew/status/1984012730878001213 · Twitter Post
• https://t.me/CVEtracker/36233 · Telegram Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44461?fts[value]=CVE-2025-34249 · Note
• https://twitter.com/VulmonFeeds/status/1984083448357699935 · Twitter Post
• https://vulncheck.com/advisories/nagios-fusion-2fa-brute-force-bypass · Note