Description
An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Nagios | Nagios XI | < 5.9.3 | 5.9.3 |
Advisories 1
- WID-SEC-2023-0316 Nagios Enterprises Nagios XI: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 13, 2026