Read the docs
TI-2023-09819 Aliases CVE-2023-24035GHSA-4w2r-vx7w-6p4w

An issue was discovered in Nagios XI before 5.9.3.

Priority LOW 18CWE-208Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-208.

Summary

An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00733 54th percentileScored 2026-11-07
Fix Fixed Nagios XI (Nagios): 5.9.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NagiosNagios XIbefore 5.9.35.9.3Patch availableCNA
  • Nagios XI VendorNagios Affected before 5.9.3 Fixed in 5.9.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*——Nagios
  • cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:* Versions — — ·Nagios

Remediation

  • Fix · CNA Nagios XI (Nagios) Fixed in 5.9.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Nagios XI 5.9.3

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-24035
  2. 2026-10-03 Alias added: GHSA-4w2r-vx7w-6p4w

References

Other 2

  • TI-2021-07545 Nagios XI version xi-5.7.5 is affected by OS command injection. KEVCVSS 3.1HIGH 8.8
  • TI-2021-07544 Nagios XI version xi-5.7.5 is affected by OS command injection. KEVCVSS 3.1HIGH 8.8
  • TI-2021-07543 Nagios XI version xi-5.7.5 is affected by OS command injection. KEVCVSS 3.1HIGH 8.8
  • TI-2019-11993 Nagios XI before 5.6.6 allows remote command execution as root. KEVCVSS 3.1HIGH 8.8
  • TI-2023-26027 Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE)… CVSS 3.1CRITICAL 9.8
  • TI-2021-15313 Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution… CVSS 3.1CRITICAL 9.8
See all 302 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences