Icinga 2 CVE-2025-61908

Requires an authenticated Icinga 2 API user (PR:L) with access to an API endpoint that permits specifying a filter expression; the attacker crafts an invalid reference such as a reference to null inside that filter, whose dereference triggers the segfault. Limiting factors: valid API credentials and filter-expression permission are mandatory, so anonymous/unauthenticated exploitation is not possible; impact is limited to crashing the daemon (availability only). Affected deployments are Icinga 2 versions 2.10.0 up to (but not including) 2.15.1, 2.14.7, and 2.13.13.

This is a moderate-priority availability issue, not a high-urgency emergency. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VA:H and both VC and VI at N confirms a pure denial-of-service: an attacker can crash the daemon but cannot read or alter data. The score of 7.1 is driven entirely by availability impact against a network-reachable service. Critically, exploitation requires PR:L - a legitimate authenticated API user with permission to submit a filter expression - which meaningfully narrows the threat to insiders or holders of compromised API credentials rather than anonymous internet attackers. The supporting signals agree on lower real-world urgency: EPSS is only 0.54% (44th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit code was identified. CWE-476 (null pointer dereference) is consistent with the described segfault. There is no SSVC decision data in the input to evaluate automatable/exploitation status formally. The one point worth flagging: while the bug is trivial to trigger once authenticated (the patch introduces a proper Reference type with REQUIRE_NOT_NULL guards, confirming the root cause), the authentication barrier and lack of any confidentiality/integrity impact keep this out of the 'drop everything' category. Treat as a prompt-patch availability risk, especially where API access is broadly granted.

An authenticated Icinga 2 API user - or an attacker who has obtained valid API credentials - sends a request to an endpoint that accepts a filter expression and crafts an invalid reference (e.g., a reference to null). When the daemon dereferences it, a null pointer dereference causes a segmentation fault that crashes the monitoring daemon, disrupting all monitoring. No public exploit code was identified at time of analysis, but the trigger is simple and well-documented by the vendor's fix.