Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization
Summary
| CVE | CVE-2024-13994 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-10-30 22:15:44 UTC |
| Updated | 2026-10-02 00:10:00 UTC |
| Description | Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead to unauthorized account creation, privilege escalation, or full compromise of the Nagios XI web interface depending on the target account. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.009180000 probability, percentile 0.588720000 (date 2026-10-05)
Problem Types: CWE-862 | CWE-862 CWE-862 Missing Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Nagios | Nagios Xi | All | All | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.0.1 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.0.2 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.1 | All | All |
| Application | Nagios | Nagios Xi | 2024 | r1.1.1 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.nagios.com/changelog/nagios-xi | [email protected] | www.nagios.com | Release Notes |
| www.vulncheck.com/advisories/nagios-xi-allow-insecure-logins-missing-authorization | [email protected] | www.vulncheck.com | Third Party Advisory |
| www.nagios.com/products/security | [email protected] | www.nagios.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Kevin De Frene (en)
Additional Advisory Data
Solutions
CNA: Nagios addresses this vulnerability as "Nagios XI versions 2024R1.1.1 and earlier are missing authorization controls when "Allow Insecure Logins" is enabled, allowing any user to create a valid login credential for other users" and "Fixed an issue where any user could modify an insecure login ticket."