Cyber Posture

CVE-2024-13995

HighPublic PoC

Published: 30 October 2025

Published
30 October 2025
Modified
06 November 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0167 82.2th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.

Security Summary

CVE-2024-13995 is an information disclosure vulnerability (CWE-497) affecting Nagios XI monitoring software versions prior to 2024R1.1.2, with the issue confirmed in versions 2024R1.1 and 2024R1.1.1. The flaw enables authenticated users to access sensitive user account information, including API keys and hashed passwords, that they are not authorized to view.

An attacker with low-privilege authenticated access (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), resulting in high impacts to confidentiality, integrity, and availability (CVSS:3.1 score of 8.8; C:H/I:H/A:H; S:U). Successful exploitation could lead to full account compromise, abuse of API privileges, or offline cracking attempts against exposed password hashes.

Advisories recommend upgrading to Nagios XI 2024R1.1.2 or later to mitigate the issue. Additional details are available in the Nagios changelog at https://www.nagios.com/changelog/nagios-xi/, the Nagios security page at https://www.nagios.com/products/security/#nagios-xi, and the VulnCheck advisory at https://www.vulncheck.com/advisories/nagios-xi-api-keys-and-hashed-password-authenticated-information-disclosure.

Details

CWE(s)
CWE-497

Affected Products

nagios
nagios xi
2024 · ≤ 2024

MITRE ATT&CK Enterprise Techniques

T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
T1528 Steal Application Access Token Credential Access
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
T1110.002 Password Cracking Credential Access
Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.
Why these techniques?

Vulnerability enables exploitation for credential access (T1212) by disclosing API keys (enabling T1528 Steal Application Access Token) and hashed passwords (facilitating T1110.002 Password Cracking).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References