Centreon Infra Monitoring CVE-2025-54890

Exploitation requires an authenticated account with elevated/administrative privileges capable of editing the Hostgroup configuration page in Centreon Infra Monitoring (Centreon Web), since the payload is injected and stored there (PR:H). Triggering the stored payload additionally requires a second user to view the affected Hostgroup configuration view (UI:R), so this is not self-contained remote code execution. Limiting factors: the need for a pre-existing privileged account sharply narrows the threat population to insiders or already-compromised admin sessions, and only instances running affected versions below 24.10.15 / 24.04.19 / 23.10.29 are vulnerable. There is no special non-default feature toggle implied - the Hostgroup configuration page is standard functionality.

This is a genuinely medium-to-low priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) describes a stored XSS that requires an attacker to already hold elevated/administrative privileges (PR:H) and requires a victim to view the affected page (UI:R); the scope change (S:C) reflects that injected script executes in another user's browser context. The 4.8 base score and limited C/I/A (Low/Low/None) indicate constrained impact. EPSS is low at 0.19% (9th percentile), the CVE is NOT listed in CISA KEV, and no public exploit is referenced - all three signals agree this is not under active or imminent widespread exploitation. The PR:H requirement is the dominant limiting factor: an attacker needs an already-privileged account to plant the payload, which turns this into a privilege-abuse / insider or post-compromise escalation vector rather than a drive-by remote threat. No key signals conflict; the main value here is recognizing that the high-privilege prerequisite meaningfully lowers real-world urgency despite the network attack vector.

A user with elevated Centreon configuration privileges injects a malicious script into a field on the Hostgroup configuration page, which is stored persistently. When another operator or administrator later opens that Hostgroup configuration view, the script executes in their authenticated session (scope change), potentially enabling session/token theft or actions in their browser context. No public exploit code is referenced, and exploitation requires both the privileged account to plant the payload and a victim to view the affected page (UI:R).