PT-2025-44497 · Nagios Enterprises · Nagios Xi

Published 2025-10-30 · Updated 2025-10-31 · CVE-2024-13994

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.2

Description Nagios XI versions prior to 2024R1.1.2 have a flaw where authorization checks are absent when the 'Allow Insecure Logins' option is active. This allows any user to generate valid login credentials for other users without the necessary permissions. Successful exploitation could result in unauthorized account creation, privilege escalation, or complete compromise of the Nagios XI web interface, depending on the targeted account.

Recommendations Update Nagios XI to version 2024R1.1.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-14704

CVE-2024-13994

Affected Products

Nagios Xi

References · 8

• https://osv.dev/vulnerability/CVE-2024-13994 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14704 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13994 · Security Note
• https://nagios.com/changelog/nagios-xi · Patch
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://vulncheck.com/advisories/nagios-xi-allow-insecure-logins-missing-authorization · Note
• https://twitter.com/VulmonFeeds/status/1984137200187928982 · Twitter Post
• https://twitter.com/CVEnew/status/1984012705917722822 · Twitter Post