CVE-2025-61909 json
Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user
published last yr. modified last mo. also EUVD-2025-34791
- cvss
- 4.4
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
Patch / fix
- icinga icinga 2.13.13, 2.14.7, 2.15.1
- icinga2 Debian 13 2.14.6-1+deb13u1
- icinga2 Debian 14 2.15.1-1
debian advisories DEBIAN-CVE-2025-61909
- icinga2 openSUSE Tumbleweed 2.15.1-1.1
opensuse advisories openSUSE-SU-2025:15644-1
Is CVE-2025-61909 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.0 | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H |
| CNA | 4.0 | 4.0 | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.4 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Icinga icinga2
Classification
- Weakness
-
- CWE-250 Execution with Unnecessary Privileges
References
-
github.com
/Icinga/icinga2/commit/51ec73cbd922a76fc0f60e1d8d33acd7caa5d587
patch
-
github.com
/Icinga/icinga2/security/advisories/GHSA-pg6g-g99v-mw46
patch, vendor-advisory
-
github.com
/Icinga/icinga2/issues/10527
issue-tracking
-
icinga.com
/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4
release-notes
Sources
- CVE List CVE-2025-61909
- NVD CVE-2025-61909
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.