CVE-2025-48057

published 2025-05-27

CVE-2025-48057: Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting…

Priority P3 57 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as valid. This allows an attacker to send a malicious certificate request that is then treated as a renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes. This only occurs when Icinga 2 is built with OpenSSL older than version 1.1.0. This issue has been patched in versions 2.12.12, 2.13.12, and 2.14.6.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	icinga2	< icinga2 2.14.6-1 (forky)	icinga2 2.14.6-1 (forky)
icinga	icinga	< 2.12.12	2.12.12
icinga	icinga	>= 2.13.0 < 2.13.12	2.13.12
icinga	icinga	>= 2.14.0 < 2.14.6	2.14.6
icinga	icinga2	< 2.12.12	2.12.12
icinga	icinga2	—	—
icinga	icinga2	—	—
icinga	icinga2	>= 0 < 2.14.6-1	2.14.6-1
icinga	icinga2	>= 0 < 2.14.6-1	2.14.6-1

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv 9.3 CRITICAL

vendor_debian 9.3 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-296