CVE-2025-48057 Icinga 2 certificate renewal might incorrectly renew an invalid certificate

What is CVE-2025-48057?

CVE-2025-48057 is a critical vulnerability in icinga2, published on 27 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as valid. This allows an attacker to send a malicious certificate request that is then treated as a renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes. This only occurs when Icinga 2 is built with OpenSSL older than version 1.1.0. This issue has been patched in versions 2.12.12, 2.13.12, and 2.14.6.

Weakness: CWE-296

Which versions are affected by CVE-2025-48057?

It affects 1 product.

Products include Icinga Icinga.

How do I fix CVE-2025-48057?

Upgrade to a fixed version.

Is CVE-2025-48057 being exploited?

There is no known exploitation of CVE-2025-48057 in the wild and no public exploit code.

Other vulnerabilities in icinga2

• CVE-2020-29663 Security feature bypass in n/a Critical 9.1
• CVE-2024-24820 Icinga Director configuration is susceptible to Cross-Site Request Forgery High 8.3
• CVE-2018-6535 Information disclosure in n/a High 8.1
• CVE-2020-14004 Path traversal in n/a High 7.8
• CVE-2018-6533 Privilege escalation in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-48057, GHSA-7vcf-f5v9-3wr6, SUSE-SU-2025:02783-1, UBUNTU-CVE-2025-48057, openSUSE-SU-2025:15180-1.