CVE-2025-28132
Last modified
CVE-2025-28132 is a medium-severity vulnerability rated 4.6/10 on the CVSS scale. A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized access and account takeover. This occurs due to insufficient session expiration, where session tokens remain valid beyond logout, allowing an attacker to impersonate users and perform actions on their behalf.. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized access and account takeover. This occurs due to insufficient session expiration, where session tokens remain valid beyond logout, allowing an attacker to impersonate users and perform actions on their behalf.
Metrics
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Nagios | Nagios Network Analyzer | 2024 | R1.0.3* |
References
- https://github.com/harshal79/Insufficient-Session-Expiration.gitThird Party Advisory
- https://www.nagios.com/changelog/#network-analyzerRelease Notes
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-28132?
How severe is CVE-2025-28132?
How do I fix CVE-2025-28132?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-2812Improper Neutralization of Special Elements used in an SQL C…9.8
- CVE-2025-28121code-projects Online Exam Mastering System 1.0 is vulnerable…6.1
- CVE-2025-28128An issue in Mytel Telecom Online Account System v1.0 allows …7
- CVE-2025-28129Phpgurukul Hostel Management System 2.1 is vulnerable to cli…5.4
- CVE-2025-2813An unauthenticated remote attacker can cause a Denial of Ser…7.5
- CVE-2025-28131A Broken Access Control vulnerability in Nagios Network Anal…4.6
- CVE-2025-28135TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain …7.5
- CVE-2025-28136TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain …6.5
- CVE-2025-28137The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to con…9.8
- CVE-2025-28138The TOTOLINK A800R V4.1.2cu.5137_B20200730 were found to con…9.8
- CVE-2025-2814Crypt::CBC versions between 1.21 and 3.05 for Perl may use t…4
- CVE-2025-28142Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1…6.5
Are you affected by CVE-2025-28132?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST