CVE-2025-61908: 
Icinga vulnerability analysis and mitigation

CVE-2025-61908 is a NULL Pointer Dereference (DoS) vulnerability in Icinga 2, an open-source monitoring system, that allows authenticated API users to crash the Icinga 2 daemon by supplying a crafted filter expression containing an invalid reference (e.g., a reference to null). The vulnerability was introduced in Icinga 2.10.0 (via PR #6521 merged August 2018) and affects all versions from 2.10.0 up to but not including 2.13.13, 2.14.7, and 2.15.1. It was publicly disclosed on October 16, 2025, with fixes released simultaneously (GitHub Advisory, Red Hat CVE). The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is a NULL Pointer Dereference (CWE-476) introduced when the reference operator feature was added to Icinga 2's DSL/configuration language in version 2.10.0. When a filter expression passed to an API endpoint creates an invalid reference — such as dereferencing a null pointer — the Icinga 2 daemon does not validate the reference before dereferencing it, resulting in a segmentation fault and process crash. The attack vector is network-based, requires low privileges (any authenticated API user), no user interaction, and low attack complexity; the attacker simply needs access to any API endpoint that accepts filter expressions, such as /v1/actions or /v1/objects (GitHub Advisory, GitHub PR). No public proof-of-concept exploit code has been identified.

Successful exploitation causes the Icinga 2 monitoring daemon to crash via a segmentation fault, resulting in a complete denial of service for the monitoring system. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Organizations relying on Icinga 2 for infrastructure monitoring would lose visibility into their environment for the duration of the outage, potentially masking other incidents or degrading operational response capability (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041%, indicating a low probability of exploitation in the near term. The vulnerability requires authenticated API access, which limits the attacker pool, though any low-privilege API user is sufficient to trigger the crash (Red Hat CVE). The vulnerability was credited to researcher "oxzi" (GitHub Advisory).

1. Obtain API credentials: Acquire any low-privilege Icinga 2 API account with access to endpoints that accept filter expressions (e.g., /v1/actions or /v1/objects).
2. Identify target: Confirm the target Icinga 2 instance is running a vulnerable version (2.10.0–2.15.0, excluding patched releases 2.13.13, 2.14.7, 2.15.1).
3. Craft malicious request: Construct an API request to a filter-accepting endpoint (e.g., GET /v1/objects/hosts) that includes a filter expression containing an invalid reference dereference, such as a null pointer reference using the * dereference operator on a null or invalid reference.
4. Send the request: Submit the crafted HTTP request to the Icinga 2 API (default port 5665) using the obtained credentials.
5. Trigger crash: The Icinga 2 daemon processes the filter expression, attempts to dereference the invalid reference, encounters a segmentation fault, and crashes — taking down the monitoring service (GitHub Advisory).

• Logs: Icinga 2 daemon logs (/var/log/icinga2/icinga2.log) showing unexpected process termination or segmentation fault messages; system logs (/var/log/syslog or journalctl) recording a segfault for the icinga2 process.
• Process: Sudden absence of the icinga2 daemon process; automatic restart events triggered by the init system (systemd) for the icinga2.service unit.
• Network: Repeated API requests to /v1/objects or /v1/actions endpoints from a single source IP, particularly with unusual or malformed filter expression parameters in the request body.
• File System: Core dump files generated in the Icinga 2 working directory or system core dump location following a segmentation fault.

Upgrade to one of the patched Icinga 2 versions: 2.15.1, 2.14.7, or 2.13.13, which include the fix for this vulnerability (GitHub Advisory, Icinga Blog). As a workaround where immediate patching is not possible, restrict API access strictly to trusted and necessary users only, since the vulnerability can only be exploited by authenticated API users. Note that there is no practical configuration-level workaround that prevents exploitation without removing API permissions entirely, as all endpoints accepting filter expressions (including /v1/actions and /v1/objects) are affected (GitHub Advisory).

Icinga published a security release announcement alongside the patched versions on October 16, 2025, covering this and related fixes (Icinga Blog). Würth Phoenix published a NetEye security advisory referencing the Icinga 2 vulnerability, indicating downstream product impact for users of their NetEye monitoring platform. Tenable added detection coverage via Nessus plugin 270722 shortly after disclosure. No significant broader social media or researcher commentary has been identified beyond standard vulnerability tracking and vendor response.