Icinga 2 certificate renewal might incorrectly renew an invalid certificate
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as valid. This allows an attacker to send a malicious certificate request that is then treated as a renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes. This only occurs when Icinga 2 is built with OpenSSL older than version 1.1.0. This issue has been patched in versions 2.12.12, 2.13.12, and 2.14.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Icinga | icinga2 | 2.14.0 to before 2.14.6; 2.13.0 to before 2.13.12; before 2.12.12 | 2.14.6, 2.13.12, 2.12.12 | Patch available | CNA |
- icinga2 VendorIcinga Affected 2.14.0 to before 2.14.6; 2.13.0 to before 2.13.12; before 2.12.12 Fixed in 2.14.6, 2.13.12, 2.12.12 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:* | before 2.12.12; 2.13.0 to before 2.13.12; 2.14.0 to before 2.14.6 | Vulnerable | Icinga |
- cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:* Versions before 2.12.12; 2.13.0 to before 2.13.12; 2.14.0 to before 2.14.6 Vulnerable ·Icinga
Remediation
- Fix · CNA icinga2 (Icinga) Fixed in 2.14.6, 2.13.12, 2.12.12
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48057
References
Patch 6
- https://github.com/Icinga/icinga2/security/advisories/GHSA-7vcf-f5v9-3wr6
- https://github.com/Icinga/icinga2/commit/34c93a2542bbe4e9886d15bc17ec929ead1aa152
- https://github.com/Icinga/icinga2/commit/4023128be42b18a011dda71ddee9ca79955b89cb
- https://github.com/Icinga/icinga2/commit/60f75f4a3d5cbb234eb3694ba7e9076a1a5b8776
- https://github.com/Icinga/icinga2/commit/9ad5683aab9eb392c6737ff46c830a945c9e240f
- https://github.com/Icinga/icinga2/commit/9b2c05d0cc09210bdeade77cf9a73859250fc48d
More Icinga vulnerabilities
- TI-2024-16337 Icinga Director configuration is susceptible to Cross-Site Request Forgery CVSS 3.1HIGH 8.3
- TI-2012-05060 Multiple stack-based buffer overflows in the get_history function in history.cgi in… CVSS 2.0HIGH 7.5
- TI-2013-05840 Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before… CVSS 2.0MEDIUM 5.5
- TI-2024-32957 Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections CVSS 3.1CRITICAL 9.8
- TI-2021-12411 Passwords used to access external services inadvertently exposed through API CVSS 3.1HIGH 8.8
- TI-2020-17821 Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due… CVSS 3.1CRITICAL 9.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences