CVE-2025-60424

HIGH

Nagios Fusion <2024R2 - Auth Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-60424. PoCs published by adminlove520, aakashtyal.

AI-analyzed exploit summary The repository contains a scanner for CVE-2024-21762, which checks for the presence of the vulnerability in Fortinet SSL VPN interfaces. It includes Python scripts that send crafted HTTP requests to detect if a host is vulnerable.

Description

A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack.

Exploits (2)

github SCANNER 2 stars
by adminlove520 · pythonpoc
https://github.com/adminlove520/CVE-Poc_All_in_One/tree/main/2025/CVE-2025-60424

The repository contains a scanner for CVE-2024-21762, which checks for the presence of the vulnerability in Fortinet SSL VPN interfaces. It includes Python scripts that send crafted HTTP requests to detect if a host is vulnerable.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Fortinet SSL VPN
No auth needed
Prerequisites: network access to the target host · Python environment with required dependencies
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WRITEUP
by aakashtyal · poc
https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

This repository contains a detailed writeup describing a brute-force vulnerability in Nagios Fusion's 2FA implementation (CVE-2025-60424), highlighting the lack of rate-limiting and account lockout mechanisms. It explains the attack vector and mitigation strategies but does not include exploit code.

Classification
Writeup 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Nagios Fusion 2024R1.2 and 2024R2
Auth required
Prerequisites: Valid username and password · Access to the 2FA verification endpoint
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 7.6
EPSS 0.0061
EPSS Percentile 44.3%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-287 CWE-307
Status published
Products (1)
nagios/fusion 2024 r1.2 (2 CPE variants)
Published Oct 27, 2025
Tracked Since Feb 18, 2026