CVE-2025-28059

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Apr 18, 2025
Updated: Apr 22, 2025
CWE ID 613

Summary

CVE-2025-28059 is an access control vulnerability affecting Nagios Network Analyzer 2024R1.0.3. Deleted user accounts do not have their active sessions terminated properly or their API tokens revoked, enabling unauthorized access by attackers. This issue arises due to improper session invalidation and stale token handling. Despite account deletion, these users retain access to restricted system resources, posing a significant security risk.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Nagios Network Analyzer

Affected Vendors

  • Nagios Enterprises LLC

Advisories, Assessments, and Mitigations