Centreon CVE-2025-13050

Requires a valid authenticated Centreon account with low privileges (PR:L); the attacker then abuses a missing function-level authorization check to reach poller management and invoke post-restart commands they should not be permitted to run. Exploitation is remote over the network against the Centreon web application (AV:N) with no user interaction (UI:N) and low complexity (AC:L). Limiting factors: anonymous/unauthenticated users cannot exploit this (authentication required), so realistic abuse is by legitimate low-privilege users, insiders, or holders of compromised credentials; network reachability of the Centreon interface is also required. No special non-default configuration is named in the available sources, and specific affected/fixed versions are not stated.

This is a moderate-severity (CVSS 5.4), post-authentication authorization flaw (CWE-863) rather than a top-priority emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L indicates network-reachable, low-complexity exploitation but requires an authenticated low-privilege account (PR:L) and yields only limited integrity and availability impact with no confidentiality loss (C:N/I:L/A:L). Exploitation status: no public exploit identified at time of analysis - the CVE is not in CISA KEV, no EPSS probability was supplied, and no proof-of-concept is referenced. The vuln.today decision label is 'this_month' (not act_now or emergency), which is consistent with the medium CVSS and absence of exploitation signals: remediate within the normal patch cycle rather than as an emergency. The key signal tension is that the required-authentication precondition (PR:L) sharply narrows the realistic attacker population to users who already hold a valid Centreon login, so the practical risk is primarily privilege-escalation-within-the-app / insider or compromised-account abuse rather than mass unauthenticated exploitation. EPSS and SSVC automatable/technical-impact values were not provided, so quantitative exploitation likelihood cannot be confirmed from the input.

An authenticated low-privilege Centreon user sends a request to a poller management function they should not be authorized to reach, and the missing function-level authorization check (CWE-863) lets them trigger the poller post-restart commands. Because AV:N/AC:L/UI:N, no user interaction or special timing is needed once the attacker holds any valid account, but valid credentials (PR:L) are required and impact is limited to integrity and availability of the monitoring platform. No public exploit or PoC is identified at time of analysis.