Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60425.

Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication (2FA) implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try second-factor codes for a targeted account. By abusing the lack of enforcement, an attacker could eventually successfully authenticate to accounts protected by 2FA.

Уязвимость программного средства визуализации рабочего состояния ИТ-инфраструктуры предприятия Nagios Fusion, связанная с недостаточным ограничением попыток аутентификации, позволяющая нарушителю обойти существующие ограничения безопасности