VulnerabilityPublished 27 Oct 2025

CVE-2025-60424: fusion · CVE-2025-60424 is a high-severity

Affects fusionSource CVE Database V5

Not known to be exploited · CVSS 7.6 High.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 3.1 base score

7.6High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.7% chance of exploitation in 30 days – higher than 53% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector: Adjacent
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Adjacent: The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 27 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
GitHubnagios/fusion`pkg:github/nagios/fusion`Other threats	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

1. Immediately implement network segmentation to restrict access to the Nagios Fusion management interface to trusted administrative networks only. 2. Deploy intrusion detection and prevention systems (IDS/IPS) to monitor and alert on repeated OTP verification attempts indicative of brute-force attacks. 3. Enforce strong access control policies, including limiting the number of users with low privileges who can access the OTP verification component. 4. Use multi-factor authentication methods that include additional factors beyond OTP where possible, such as hardware tokens or biometric verification. 5. Monitor authentication logs closely for unusual patterns and implement automated blocking or alerting on suspicious activity. 6. Engage with Nagios support or vendor channels to obtain official patches or updates as soon as they become available. 7. Consider temporary disabling or restricting OTP verification features if feasible until patches are applied. 8. Educate IT staff on the risks and signs of exploitation related to this vulnerability to enhance detection and response capabilities.

Description

CVE-2025-60424 is a high-severity vulnerability in Nagios Fusion versions v2024R1.2 and v2024R2 where the OTP verification component lacks rate limiting, enabling attackers with low privileges to perform brute-force attacks to bypass authentication. This flaw impacts confidentiality and integrity by allowing unauthorized access without user interaction. The vulnerability requires network access and low privileges but no user interaction, making exploitation relatively feasible in targeted environments. European organizations using affected Nagios Fusion versions for IT infrastructure monitoring could face unauthorized access risks, potentially leading to data breaches or manipulation of monitoring data. No known exploits are currently reported in the wild, but the absence of patches increases urgency for mitigation. Organizations should implement strict network segmentation, monitor authentication attempts, and apply compensating controls until official patches are released. Countries with significant Nagios Fusion deployments, such as Germany, the UK, France, and the Netherlands, are more likely to be impacted due to their large IT infrastructure sectors and reliance on monitoring tools. Given the vulnerability's characteristics and CVSS score of 7.6, it is classified as high severity.

Impact

For European organizations, this vulnerability poses a significant risk to the confidentiality and integrity of IT infrastructure monitoring data. Unauthorized access to Nagios Fusion could allow attackers to view sensitive operational data, manipulate monitoring alerts, or disable monitoring functions, potentially delaying detection of other attacks or system failures. This could lead to broader security incidents, operational disruptions, or compliance violations under regulations such as GDPR. The impact is particularly critical for sectors relying heavily on continuous monitoring, such as finance, telecommunications, energy, and government agencies. The ease of exploitation due to lack of rate limiting and no requirement for user interaction increases the threat level. Organizations with Nagios Fusion deployed in multi-tenant or segmented environments may face risks of lateral movement if attackers gain access through this vulnerability. The absence of known exploits in the wild provides a window for proactive defense, but the high severity score underscores the urgency of addressing the issue.

Summary

CVE-2025-60424 is a vulnerability identified in Nagios Fusion versions v2024R1.2 and v2024R2, specifically within the One-Time Password (OTP) verification component. The core issue is the absence of rate limiting on OTP verification attempts, which allows an attacker with low privileges to conduct brute-force attacks against the authentication mechanism. This vulnerability falls under CWE-307 (Improper Restriction of Excessive Authentication Attempts) and CWE-287 (Improper Authentication). The lack of rate limiting means that an attacker can repeatedly attempt OTP codes without being throttled or blocked, increasing the likelihood of successfully bypassing the multi-factor authentication process. The CVSS v3.1 base score is 7.6, indicating a high severity level, with the attack vector being adjacent network (AV:A), low attack complexity (AC:L), requiring privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality and integrity (C:H/I:H) with low impact on availability (A:L). Exploiting this vulnerability would allow unauthorized access to Nagios Fusion, potentially exposing sensitive monitoring data or enabling attackers to manipulate monitoring configurations. Although no public exploits are currently known, the vulnerability's characteristics make it a significant risk, especially in environments where Nagios Fusion is used for critical infrastructure monitoring. The absence of official patches necessitates immediate mitigation through compensating controls.

CWE-307Improper Restriction of Excessive Authentication Attempts (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Architecture and Design
Common protection mechanisms include: Disconnecting the user after a small number of failed attempts; Implementing a timeout; Locking out a targeted account; Requiring a computational task on the user's part.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
Authentication (opens in a new tab)
Transport Layer Protection (opens in a new tab)
TLS Cipher String (opens in a new tab)
OWASP ASVS 4.0.3
V2.2.1 (opens in a new tab)
V2.8.5 (opens in a new tab)
V2.8.4 (opens in a new tab)
Attack patterns
Dictionary-based Password Attack (opens in a new tab)
Password Brute Forcing (opens in a new tab)
Password Spraying (opens in a new tab)
Credential Stuffing (opens in a new tab)
Use of Known Kerberos Credentials (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-287Improper Authentication (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
OWASP Cheat Sheets
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V2.8.5 (opens in a new tab)
V2.8.4 (opens in a new tab)
V9.2.3 (opens in a new tab)
Attack patterns
Fake the Source of Data (opens in a new tab)
Utilizing REST's Trust in the System Resource to Obtain Sensitive Data (opens in a new tab)
Session Hijacking (opens in a new tab)
Token Impersonation (opens in a new tab)
Upload a Web Shell to a Web Server (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 3 Nov 2025, 16:14 UTC

WeaknessesCWE-307, CWE-287

Technical details

References

Community reviews

Related threats