CVE-2023-24035: Nagios Nagios XI vulnerability

Q: Which Nagios XI versions are affected?

Nagios XI versions before 5.9.3 are affected.

Q: What does an attacker need to exploit this issue?

An attacker needs to measure timing differences during the insecure password comparison and use those differences to brute-force the administrator password.

Published Sep 14, 2026

Updated

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison.

Affected Software

1 affected component

Nagios Nagios XI<5.9.3

Event History

Sep 14, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which Nagios XI versions are affected?

Nagios XI versions before 5.9.3 are affected.

What does an attacker need to exploit this issue?

An attacker needs to measure timing differences during the insecure password comparison and use those differences to brute-force the administrator password.