PT-2025-44512 · Nagios · Nagios Fusion

Published 2025-10-30 · Updated 2025-10-31 · CVE-2025-34269

Positive Technologies · (AI Summary)

CVSS v4.0

8.6

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nagios Fusion versions prior to R2.1

Description The application does not require re-authentication or session rotation when a user enables two-factor authentication (2FA). This allows an attacker who has obtained a valid session to continue using it even after the user enables 2FA, potentially leading to persistent account takeover and preventing the legitimate user from locking the attacker out.

Recommendations Update to version R2.1 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2025-15972

CVE-2025-34269

Affected Products

Nagios Fusion

References · 9

• https://bdu.fstec.ru/vul/2025-15972 · Security Note
• https://nagios.com/products/security/#fusion · Patch, Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34269 · Security Note
• https://nagios.com/changelog/nagios-fusion · Patch
• https://twitter.com/CVEnew/status/1984012729829478890 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984098804753215613 · Twitter Post
• https://vulncheck.com/advisories/nagios-fusion-2fa-lack-of-reauthentication-or-session-rotation · Note
• https://t.me/CVEtracker/36234 · Telegram Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44512 · Note