Raw vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-61909 is a medium-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Icinga Icinga. Its CVSS base score is 4.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Sudo and Sudo Caching (T1548.003); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-34791
Vulnerability Data
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2…
more
process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows a lower-privileged daemon user to abuse a root-owned reload script that reads a user-writable PID file, enabling the daemon user to send arbitrary signals (including privileged ones) to processes. This directly maps to abuse of the sudo/sudo-caching mechanism or equivalent privileged execution path (T1548.003) to escalate privileges or interfere with other processes.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly counters CWE-250 by ensuring the safe-reload and logrotate scripts do not execute with root privileges when only signal delivery based on a user-controlled PID file is required.
Enforces that the PID file cannot be written by the Icinga daemon user while the reload process still runs with root privileges, blocking the signal-sending vector.
Verifies integrity of the PID file and reload scripts before they are used under elevated privileges, detecting tampering that would allow unauthorized signals.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.AA-05 directly enforces least privilege so largely eliminates CWE-250 at design time, yet the weakness can still arise from runtime escalation paths, third-party code, or misapplied role definitions outside this single control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring explicit justification and time-limited grants discourages the routine allocation of unnecessary privileges that would otherwise allow execution with more rights than required.
Restricting privileged utilities to the fewest trusted users and requiring explicit authorization directly stops developers or operators from embedding or invoking code that runs with unnecessary elevated rights.
Mandating separate non-privileged identities for routine work and restricting privileged accounts to administrative tasks reduces the chance that everyday operations run with unnecessary elevated rights.
The control explicitly calls for minimizing privileged identities and disabling unnecessary accounts, thereby reducing the number of processes that run with unnecessary privileges.
The requirement to restrict privileged access and apply segregation of duties limits the number of processes or accounts that must run with elevated rights, lowering the impact of unnecessary privilege assignments.
Forcing distinct roles for initiating versus executing changes reduces the chance that an individual will run with unnecessary privileges to perform both steps.