CVE-2025-60425
Nagios Fusion 2024
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:LSummary
CVE-2025-60425 is a high-severity Object Hijack (CWE-491) vulnerability in Nagios Fusion. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 43% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-60425 affects Nagios Fusion versions v2024R1.2 and v2024R2, where the software fails to invalidate existing session tokens upon enabling the two-factor authentication (2FA) mechanism. This flaw, classified under CWE-491 (Masking of a Critical Element), enables session hijacking attacks and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), indicating high severity due to its network accessibility, low attack complexity, and lack of prerequisites like privileges or user interaction.
Unauthenticated attackers can exploit this vulnerability remotely by obtaining a valid session token prior to 2FA enablement—such as through phishing, malware, or prior unauthorized access—and reusing it post-2FA activation to hijack the victim's session. Successful exploitation grants attackers high integrity impact (I:H), allowing unauthorized actions like configuration changes or data manipulation under the victim's privileges, alongside low confidentiality (C:L) and availability (A:L) impacts.
Advisories and mitigation details are available in the provided references, including the Nagios changelog at https://www.nagios.com/changelog/#fusion for patch information and GitHub repositories https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA and https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA-CVE-2025-60425 for technical analysis and proof-of-concept. Security practitioners should review these for upgrade guidance and apply patches promptly.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-36198
Vulnerability Data
Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code analysis can locate public non-final clone methods before deployment.
Documented development standards can mandate secure cloning patterns and final declarations.
Engineering principles can require encapsulation and final methods to block unauthorized object creation paths.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce final clone methods and constructor invariants to block object hijacking.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards directly require final clone or defensive-copy patterns to block object hijacking.
Security testing can detect clone-related state corruption during acceptance testing.
Secure development lifecycle includes design and code reviews that can catch non-final clone methods.
Application security requirements can mandate defensive coding rules that prevent unsafe cloning.
Secure architecture principles discourage mutable state exposure via cloneable objects.