CVE-2025-15026
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
Analysis
Centreon Infra Monitoring's centreon-awie module lacks authentication on critical import functions, allowing unauthenticated attackers to access functionality that should be restricted by ACLs. Affects multiple Centreon versions. Patch available.
Technical Context
The centreon-awie module (used for configuration import/export) does not require authentication for critical functions (CWE-306). An attacker can access import functionality to inject malicious monitoring configurations, potentially gaining code execution through check commands or notification scripts.
Affected Products
Centreon Infra Monitoring 25.10.0–25.10.1, 24.10.0–24.10.2, 24.04.0–24.04.2
Remediation
Update to Centreon 25.10.2, 24.10.3, or 24.04.3. Restrict network access to the AWIE module. Review imported configurations for unauthorized changes.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today