CVE-2025-15026
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
Risk Assessment
An attacker can access administrative functions without authentication, potentially leading to unauthorized changes in the system.
Recommendation
It is recommended to update to version 25.10.2, 24.10.3, or 24.04.3 (or later) depending on the used line.
Other vulnerabilities in Centreon Infra Monitoring
See all- CVE-2025-15029Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
- CVE-2025-5965High
In the backup parameters of Centreon Infra Monitoring, a user with high privileges can concatenate custom instructions to the backup setup. Improper neutralization of special elements used in an OS command allows OS Command Injection. This affects versions from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, and from 24.04.0 before 24.04.19.
- CVE-2025-5946High
OS Command Injection vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules). On the poller parameters page, a user with high privilege can concatenate custom instructions into the poller reload command.
- CVE-2025-8460Medium
Centreon Infra Monitoring versions 24.10.0 before 24.10.5, 24.04.0 before 24.04.5, and 23.10.0 before 23.10.4 are vulnerable to Stored Cross-Site Scripting in the Notification rules and Open tickets module. The vulnerability is due to improper neutralization of input during web page generation and can be exploited by users with elevated privileges.
- CVE-2025-54890Medium
Centreon Infra Monitoring (Hostgroup configuration page) is vulnerable to Stored XSS due to improper neutralization of input during web page generation, exploitable by users with elevated privileges.
- CVE-2025-12514High
An SQL Injection vulnerability in the Open-tickets module of Centreon Infra Monitoring allows a user with elevated privileges to inject SQL code. The issue affects versions 24.10.0 through 24.10.4, 24.04.0 through 24.04.4, and 23.10.0 through 23.10.3.
- CVE-2025-10023Medium
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in Centreon Infra Monitoring (Services Meta-services modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26.
- CVE-2025-8459High
Stored XSS vulnerability in Centreon Infra Monitoring (recurrent downtime scheduler modules). Affects versions from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28 due to improper input neutralization.
- CVE-2025-8430Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
- CVE-2025-8429Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
Original NVD description (English source)
Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS