CVE-2025-34249 - OpenCVE

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60425.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nagios	Fusion

No data.

References

No reference.

History

Fri, 07 Nov 2025 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-307
CPEs	cpe:2.3:a:nagios:fusion:::::::: cpe:2.3:a:nagios:fusion:2024:r1.0.1:::::: cpe:2.3:a:nagios:fusion:2024:r1.0.2:::::: cpe:2.3:a:nagios:fusion:2024:r1.0.3:::::: cpe:2.3:a:nagios:fusion:2024:r1.1.1:::::: cpe:2.3:a:nagios:fusion:2024:r1.1:::::: cpe:2.3:a:nagios:fusion:2024:r1.2:::::: cpe:2.3:a:nagios:fusion:2024:r1:::::: cpe:2.3:a:nagios:fusion:2024:r2::::::
References	https://www.nagios.com/changelog/nagios-fusion/ https://www.nagios.com/products/security/#nagios-xi https://www.vulncheck.com/advisories/nagios-fusion-2fa-brute-force-bypass
Metrics	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Fri, 07 Nov 2025 19:15:00 +0000

Type	Values Removed	Values Added
Title	Nagios Fusion < 2024R2.1 2FA Brute Force Bypass
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 07 Nov 2025 18:30:00 +0000

Type	Values Removed	Values Added
Description	Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication (2FA) implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try second-factor codes for a targeted account. By abusing the lack of enforcement, an attacker could eventually successfully authenticate to accounts protected by 2FA.	This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60425.
Metrics	cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`	cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Thu, 06 Nov 2025 16:45:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:nagios:fusion:::::::: cpe:2.3:a:nagios:fusion:2024:r1.0.1:::::: cpe:2.3:a:nagios:fusion:2024:r1.0.2:::::: cpe:2.3:a:nagios:fusion:2024:r1.0.3:::::: cpe:2.3:a:nagios:fusion:2024:r1.1.1:::::: cpe:2.3:a:nagios:fusion:2024:r1.1:::::: cpe:2.3:a:nagios:fusion:2024:r1.2:::::: cpe:2.3:a:nagios:fusion:2024:r1:::::: cpe:2.3:a:nagios:fusion:2024:r2::::::
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 31 Oct 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 31 Oct 2025 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Nagios Nagios fusion
Vendors & Products		Nagios Nagios fusion

Thu, 30 Oct 2025 21:30:00 +0000

Type	Values Removed	Values Added
Description		Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication (2FA) implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try second-factor codes for a targeted account. By abusing the lack of enforcement, an attacker could eventually successfully authenticate to accounts protected by 2FA.
Title		Nagios Fusion < 2024R2.1 2FA Brute Force Bypass
Weaknesses		CWE-307
References		https://www.nagios.com/changelog/nagios-fusion/ https://www.nagios.com/products/security/#nagios-xi https://www.vulncheck.com/advisories/nagios-fusion-2fa-brute-force-bypass
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`