Centreon Infra Monitoring CVE-2025-54889

Exploitation requires an authenticated account with elevated (administrative) privileges in Centreon Infra Monitoring and access to the SNMP traps manufacturer configuration modules, where the malicious input is stored (PR:H). Triggering the payload additionally requires a second privileged user to view the affected configuration page (UI:R), so it is not self-executing. Affected deployments are Infra Monitoring 24.10.0-24.10.12, 24.04.0-24.04.17, and 23.10.0-23.10.27; fixed releases (24.10.13, 24.04.18, 23.10.28) are not vulnerable. These high-privilege and user-interaction prerequisites are the primary limiting factors keeping real-world risk low despite the network attack vector.

This is a medium-severity stored XSS (CVSS 4.8, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) that signals a genuine but low-priority issue rather than an urgent one. The attack vector is network (AV:N) with low complexity (AC:L), but exploitation requires high privileges (PR:H) and victim user interaction (UI:R), which substantially limits real-world impact - an attacker must already hold an elevated/administrative Centreon account to plant the payload. All exploitation signals point the same direction and are consistent: EPSS is low at 0.26% (16th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. The low EPSS aligns with the high-privilege precondition, so there is no conflict among signals. The scope change (S:C) and only Low confidentiality/integrity impact (no availability impact) mean a successful attack could execute script in another user's authenticated browser session but cannot directly destroy or fully compromise data. Net assessment: a real defense-in-depth concern for Centreon operators (privilege escalation / lateral movement between admin users via script execution), but not a widespread, automatable, or actively exploited threat warranting emergency patching.

An attacker who has compromised or been granted an elevated-privilege Centreon account navigates to the SNMP traps manufacturer configuration module and saves a crafted field containing a malicious script payload. When another privileged user later views that configuration page, the stored script executes in their authenticated browser session, enabling session actions or data theft within the Centreon web interface. No public exploit code was identified at time of analysis, so this is a plausible but not demonstrated-in-the-wild scenario.