CVE-2025-60425

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-60425
Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA Mitigation Third Party Advisory
https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA-CVE-2025-60425 Mitigation Third Party Advisory
https://www.nagios.com/changelog/#fusion Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nagios:fusion:2024:r1.2:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r2.1:*:*:*:*:*:*
History

05 Nov 2025, 20:55

Type Values Removed Values Added
CPE cpe:2.3:a:nagios:fusion:2024:r2.1:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.2:*:*:*:*:*:*
References () https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA - () https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA - Mitigation, Third Party Advisory
References () https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA-CVE-2025-60425 - () https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA-CVE-2025-60425 - Mitigation, Third Party Advisory
References () https://www.nagios.com/changelog/#fusion - () https://www.nagios.com/changelog/#fusion - Release Notes
First Time Nagios
Nagios fusion
Information

Published : 2025-10-27 16:15

Updated : 2025-11-05 20:55

NVD link : CVE-2025-60425

Mitre link : CVE-2025-60425

CVE.ORG link : CVE-2025-60425

JSON object : View

Products Affected

nagios

  • fusion
CWE
CWE-491

Public cloneable() Method Without Final ('Object Hijack')