CVE-2025-61909
published 2025-10-16CVE-2025-61909: Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload…
PriorityP419medium4.4CVSS 3.1
AVLACLPRHUINSUCNINAH
EPSS
0.20%
9.4th percentile
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | icinga2 | < icinga2 2.15.1-1 (forky) | icinga2 2.15.1-1 (forky) |
| icinga | icinga | — | — |
| icinga | icinga | >= 2.10.0 < 2.13.13 | 2.13.13 |
| icinga | icinga | >= 2.14.0 < 2.14.7 | 2.14.7 |
| icinga | icinga2 | — | — |
| icinga | icinga2 | — | — |
| icinga | icinga2 | — | — |
| icinga | icinga2 | >= 0 < 2.15.1-1 | 2.15.1-1 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
nvdv4.04.0MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv4.0MEDIUM
vendor_debian4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2025-61909: icinga2 - Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14...
vendor_debian·2025·CVSS 4.0
CVE-2025-61909 [MEDIUM] CVE-2025-61909: icinga2 - Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14...
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.15.1-1)
sid: resolved (fixed in 2.15.1-1)
trixie: open
OSV
CVE-2025-61909: Icinga 2 is an open source monitoring system
osv·2025-10-16·CVSS 4.0
CVE-2025-61909 [MEDIUM] CVE-2025-61909: Icinga 2 is an open source monitoring system
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
No detection rules found.
No public exploits indexed.
https://github.com/Icinga/icinga2/commit/51ec73cbd922a76fc0f60e1d8d33acd7caa5d587https://github.com/Icinga/icinga2/issues/10527https://github.com/Icinga/icinga2/security/advisories/GHSA-pg6g-g99v-mw46https://icinga.com/blog/releasing-icinga-2-v2-15-1-2-14-7-and-2-13-13-and-icinga-db-web-v1-2-3-and-1-1-4
2025-10-16
Published