Centreon Infra Monitoring CVE-2025-10023

Exploitation requires an authenticated Centreon account with elevated (administrative/configuration) privileges able to edit the Services or Meta-services modules - consistent with PR:H - and a separate victim user who subsequently loads the page containing the stored payload (UI:R). It is therefore not exploitable by anonymous or low-privilege users and is not a default-configuration remote-unauthenticated flaw. Affected deployments are Centreon Infra Monitoring 24.10.0 before 24.10.9, 24.04.0 before 24.04.16, and 23.10.0 before 23.10.26; patched builds are not vulnerable. The practical limiting factors are the high privilege prerequisite and the dependence on a second user viewing the injected content.

This is a genuinely low-to-moderate priority issue, not a top-tier emergency. The CVSS 3.1 base score of 4.8 (Medium) is driven down by two strong limiting metrics: PR:H (the attacker must already hold elevated/administrative privileges in Centreon) and UI:R (a second user must view the poisoned page). The AV:N and AC:L metrics show the attack is network-reachable and technically simple once those preconditions are met, and S:C reflects that the injected script executes in a victim's browser context rather than the attacker's. Signal corroboration is consistent and non-conflicting: EPSS is only 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit was identified - all three independent signals agree this is low real-world exploitation pressure. No SSVC decision data was provided in the input. The main residual risk is insider/privilege-abuse or a chained attack where a lower-trust admin targets a higher-trust operator; it is not a mass-exploitation candidate. A vendor patch is available, so remediation is straightforward.

An attacker who already holds an elevated-privilege Centreon account injects a malicious JavaScript payload into a Services or Meta-services configuration field. The payload is stored and later rendered when another operator or administrator opens the affected monitoring page, executing script in that victim's authenticated session. No public exploit code was identified, so this would require a bespoke payload.