PT-2025-44498 · Nagios Enterprises · Nagios Xi

Published 2025-10-30 · Updated 2025-11-04 · CVE-2024-13995

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.2

Description Nagios XI versions prior to 2024R1.1.2 may disclose sensitive user account information, including API keys and hashed passwords, to authenticated users who should not have access to this data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts.

Recommendations Update to version 2024R1.1.2 or later.

Fix

Weakness Enumeration

CWE-497

Related Identifiers

BDU:2025-14302

CVE-2024-13995

Affected Products

Nagios Xi

References · 10

• https://bdu.fstec.ru/vul/2025-14302 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13995 · Vendor Advisory
• https://nagios.com/changelog/nagios-xi · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-13995 · Security Note
• https://twitter.com/VulmonFeeds/status/1984139759979999512 · Twitter Post
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44498?fts[value]=CVE-2024-13995 · Note
• https://vulncheck.com/advisories/nagios-xi-api-keys-and-hashed-password-authenticated-information-disclosure · Note
• https://t.me/CVEtracker/36451 · Telegram Post
• https://twitter.com/CVEnew/status/1984012703887724571 · Twitter Post