CVE-2025-34249

View on CVE.org
Published Oct 30, 2025 CVSS n/a EPSS n/a KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60425.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References

No reference.

History
Type Values Removed Values Added
Weaknesses CWE-307
CPEs cpe:2.3:a:nagios:fusion:*:*:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.0.1:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.0.2:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.0.3:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.1.1:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.1:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.2:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r2:*:*:*:*:*:*
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}
Type Values Removed Values Added
Title Nagios Fusion < 2024R2.1 2FA Brute Force Bypass
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication (2FA) implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try second-factor codes for a targeted account. By abusing the lack of enforcement, an attacker could eventually successfully authenticate to accounts protected by 2FA. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60425.
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}
Type Values Removed Values Added
CPEs cpe:2.3:a:nagios:fusion:*:*:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.0.1:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.0.2:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.0.3:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.1.1:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.1:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1.2:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r1:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r2:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Nagios
Nagios fusion
Vendors & Products Nagios
Nagios fusion
Type Values Removed Values Added
Description Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication (2FA) implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try second-factor codes for a targeted account. By abusing the lack of enforcement, an attacker could eventually successfully authenticate to accounts protected by 2FA.
Title Nagios Fusion < 2024R2.1 2FA Brute Force Bypass
Weaknesses CWE-307
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Earlier changes (2)
Weaknesses

No weakness.

Sources

Status
REJECTED
Assigner
VulnCheck
Published
Updated
Nov 7, 2025, 6:19 PM
Reserved
Apr 15, 2025, 7:15 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Oct 30, 2025, 10:15 PM
Modified
Nov 9, 2026, 8:10 PM

View source JSON

No data.

No data.