High severity · published Oct 30, 2025
CVE-2024-13995
Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to…
8.8
CVSS
1.3%
EPSS
No
On KEV
Description
Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NX
Nagios XI · Nagios
before 2024; 2024; 2024; 2024; 2024; 2024 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-13995
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-13995
Release Notes
https://www.nagios.com/changelog/nagios-xi/
Vendor Advisory
https://www.nagios.com/products/security/#nagios-xi
Third Party Advisory
https://www.vulncheck.com/advisories/nagios-xi-api-keys-and-hashed-password-authenticated-information-disclosure
More from Nagios XI
8.8
CVE-2021-25297
Nagios XI OS Command Injection
8.8
CVE-2021-25298
Nagios XI OS Command Injection
8.8
CVE-2021-25296
Nagios XI OS Command Injection
8.8
CVE-2019-15949
Nagios XI Remote Code Execution Vulnerability
9.8
CVE-2024-13994
Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create…