Introduction
Attackers can automate OTP brute-force attempts against Nagios Fusion's two-factor authentication and may gain unauthorized access to critical monitoring infrastructure. The flaw affects production deployments of Nagios Fusion v2024R1.2 and v2024R2, which are widely used for centralized monitoring and management in enterprise environments.
Nagios Enterprises is an established infrastructure monitoring vendor whose products include Nagios Core, Nagios XI, and Nagios Fusion. Thousands of organizations around the world use these products to monitor their IT infrastructure, so a vulnerability in one of them has a particularly large effect on operational security and visibility.
Technical information
CVE-2025-60424 comes from missing rate limiting on the OTP verification endpoint in Nagios Fusion. After a user authenticates with a valid username and password, the application prompts for a one-time password (OTP) as a second authentication factor. The vulnerable versions do not restrict the number of OTP attempts per user, session, or IP address, and they have no progressive account lockout after repeated failures.
An attacker with valid credentials can automate OTP submissions with tools like cURL or Python scripts. OTPs are typically 6-digit numbers, so the attacker has at most 1,000,000 combinations to try. With no rate limiting, the attacker can test every combination in a short period if server and network resources allow. A correct OTP gives the attacker the authenticated session and access to the Nagios Fusion administrative interface.
The root cause is that the 2FA endpoint has neither rate limiting nor account lockout. The issue is classified under:
- CWE-287: Improper Authentication
- CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected systems and versions
- Nagios Fusion v2024R1.2
- Nagios Fusion v2024R2
- Only these versions are confirmed vulnerable. The issue is fixed in version 2024R2.1.
- Every configuration that uses the built-in OTP-based two-factor authentication is affected.
Vendor security history
Nagios Enterprises has a history of authentication and access control vulnerabilities across its product line. Earlier issues include remote code execution, privilege escalation, and API key exposure in products like Nagios XI and Nagios Log Server. Its patch response times are generally within industry norms, but similar flaws keep recurring, which points to a need for better secure development practices and architectural review.
