← Vulnerability feed

Vulnerability record · CVE-2025-60425 · published 27 October 2025

CVE-2025-60425: Nagios fusion vulnerability

Nagios · Fusion

Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.

8.6 CVSS 3.1 High EPSS 0.92% · top 41.2% CWE-491 · CWE-491
8.6CVSS 3.1 base score
0.92%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA MitigationThird Party Advisory
https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA-CVE-2025-60425 MitigationThird Party Advisory
https://www.nagios.com/changelog/#fusion Release Notes

Track CVE-2025-60425 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-28907Nagios fusion improper certificate validation vulnerabilityIncorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors rel…EPSS 3.4%9.8CVE-2020-28908Nagios fusion command injection vulnerabilityCommand Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios.EPSS 5.7%9.8CVE-2020-28900Nagios fusion insufficient verification of data authenticity vulnerabilityInsufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges…EPSS 2.4%9.8CVE-2020-28901Nagios fusion command injection vulnerabilityCommand Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt compone…EPSS 9.1%9.8CVE-2020-28902Nagios fusion command injection vulnerabilityCommand Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.EPSS 6.4%9.8CVE-2020-28904Nagios fusion improper privilege management vulnerabilityExecution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious co…EPSS 3.6%8.8CVE-2020-28906Nagios fusion incorrect default permissions vulnerabilityIncorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged…EPSS 4.7%8.8CVE-2020-28909Nagios fusion incorrect permission assignment vulnerabilityIncorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges use…EPSS 5.1%

Source: NIST National Vulnerability Database (record CVE-2025-60425), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.