CVE-2025-61909

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Icinga/icinga2/commit/51ec73cbd922a76fc0f60e1d8d33acd7caa5d587	Patch
https://github.com/Icinga/icinga2/issues/10527	Issue Tracking
https://github.com/Icinga/icinga2/security/advisories/GHSA-pg6g-g99v-mw46	Patch Vendor Advisory
https://icinga.com/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:icinga:icinga::::::::
	cpe:2.3:a:icinga:icinga::::::::
	cpe:2.3:a:icinga:icinga:2.15.0:::::::*

History

09 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Icinga 2 es un sistema de monitorización de código abierto. Desde la versión 2.10.0 hasta antes de las versiones 2.15.1, 2.14.7 y 2.13.13, el script safe-reload (también utilizado durante systemctl reload icinga2) y la configuración de logrotate incluidos con Icinga 2 leían el PID del proceso principal de Icinga 2 de un archivo PID escribible por el usuario daemon, pero enviaban la señal como el usuario root. Esto puede permitir al usuario Icinga enviar señales a procesos a los que de otro modo no se le permitiría. Una solución está incluida en las siguientes versiones de Icinga 2: 2.15.1, 2.14.7 y 2.13.13.

Information

Published : 2025-10-16 18:15

Updated : 2026-10-09 10:10

NVD link : CVE-2025-61909

Mitre link : CVE-2025-61909

CVE.ORG link : CVE-2025-61909

JSON object : View

Products Affected

icinga

icinga

CWE

CWE-250

Execution with Unnecessary Privileges

{"id": "CVE-2025-61909", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61909", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-16T18:28:59.888518Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.0, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Icinga", "product": "icinga2", "versions": [{"status": "affected", "version": ">=2.10.0, < 2.13.13"}, {"status": "affected", "version": ">=2.14.0, < 2.14.7"}, {"status": "affected", "version": ">=2.15.0, < 2.15.1"}]}]}], "published": "2025-10-16T18:15:38.427", "references": [{"url": "https://github.com/Icinga/icinga2/commit/51ec73cbd922a76fc0f60e1d8d33acd7caa5d587", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Icinga/icinga2/issues/10527", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Icinga/icinga2/security/advisories/GHSA-pg6g-g99v-mw46", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://icinga.com/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-250"}]}], "descriptions": [{"lang": "en", "value": "Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13."}, {"lang": "es", "value": "Icinga 2 es un sistema de monitorizaci\u00f3n de c\u00f3digo abierto. Desde la versi\u00f3n 2.10.0 hasta antes de las versiones 2.15.1, 2.14.7 y 2.13.13, el script safe-reload (tambi\u00e9n utilizado durante systemctl reload icinga2) y la configuraci\u00f3n de logrotate incluidos con Icinga 2 le\u00edan el PID del proceso principal de Icinga 2 de un archivo PID escribible por el usuario daemon, pero enviaban la se\u00f1al como el usuario root. Esto puede permitir al usuario Icinga enviar se\u00f1ales a procesos a los que de otro modo no se le permitir\u00eda. Una soluci\u00f3n est\u00e1 incluida en las siguientes versiones de Icinga 2: 2.15.1, 2.14.7 y 2.13.13."}], "lastModified": "2026-10-09T10:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D988404-9FCC-4EE1-9826-4190836FB576", "versionEndExcluding": "2.13.13", "versionStartIncluding": "2.10.0"}, {"criteria": "cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97F3EEA9-4057-4878-878D-AC7936D5C4BF", "versionEndExcluding": "2.14.7", "versionStartIncluding": "2.14.0"}, {"criteria": "cpe:2.3:a:icinga:icinga:2.15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "686BD1F1-5759-46F8-BAF4-72A481C53D4E"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}