CVE-2024-49369

criticalpriority · track · 11EPSS 0.029 · 87 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

2.92% (87th) EPSS

CVSS 9.8 · critical

Is it mine?

25 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-26

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · security-advisories@github.comexploitability 3.9 · impact 5.9

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-295USCWE-295US

exploits (1)

Public proof-of-concept and weaponised exploit code.

Quantum-Sicarius/CVE-2024-49369Quantum-Sicarius/CVE-2024-49369PoC · poc_in_github

affected products (25)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
Open Source Icinga <v2.11.12all versionscert_bundDE
Open Source Icinga <v2.12.11all versionscert_bundDE
Open Source Icinga <v2.13.10all versionscert_bundDE
Open Source Icinga <v2.14.3all versionscert_bundDE
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Open Source Icinga< v2.11.12cert_bundDE
Open Source Icinga< v2.12.11cert_bundDE
Open Source Icinga< v2.13.10cert_bundDE
Open Source Icinga< v2.14.3cert_bundDE
Icinga icinga22.12.0, → 2.12.11enisa_euvdEU
Icinga icinga22.13.0, → 2.13.10enisa_euvdEU
Icinga icinga22.14.0, → 2.14.3enisa_euvdEU
Icinga icinga22.4.0, → 2.11.12enisa_euvdEU
Icinga GmbH Icinga2.12.0 → 2.12.11fstec_bduRU
Icinga GmbH Icinga2.13.0 → 2.13.10fstec_bduRU
Icinga GmbH Icinga2.14.0 → 2.14.3fstec_bduRU
Icinga GmbH Icinga2.4.0 → 2.11.12fstec_bduRU
АО «ИВК» АЛЬТ СП 10all versionsfstec_bduRU

showing 20 of 25

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-3429Icinga: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2024-11-12csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Icinga ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2024-11-12modified 2026-06-17

references (23)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan