CVE-2025-5946 is an OS Command Injection vulnerability in Centreon Infra Monitoring, affecting versions 24.10.0-24.10.12, 24.04.0-24.04.17, and 23.10.0-23.10.27. A highly privileged user can inject custom commands into the poller reload function, leading to remote code execution. With a CVSS score of 7.2 (High), this vulnerability allows an unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability. While not currently listed in CISA KEV, a Metasploit module exists, and it has garnered significant community discussion, indicating a high potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 23.10.0, < 23.10.28CPE matchmatch criteria | cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:* | ||
>= 24.04.0, < 24.04.18CPE matchmatch criteria | cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:* | ||
>= 24.10.0, < 24.10.13CPE matchmatch criteria | cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.