Centreon Web CVE-2025-54892

Exploitation requires an authenticated Centreon Web user with ELEVATED/administrative privileges (PR:H) who has access to the SNMP traps group configuration modules - the description explicitly scopes this to 'users with elevated privileges,' making privileged access the gating prerequisite. Because it is STORED XSS, a second limiting factor is required user interaction (UI:R): a victim user must subsequently load the page rendering the unneutralized input for the payload to fire. The impact is confined to Low confidentiality and Low integrity in the victim's browser session with no availability impact. These factors - a high-privilege injector plus a separate interacting victim - substantially narrow realistic exploitation to insider or post-compromise scenarios rather than opportunistic external attack. Affected deployments are Infra Monitoring 24.10.0-24.10.12, 24.04.0-24.04.17, and 23.10.0-23.10.27; versions 24.10.13, 24.04.18, and 23.10.28 and later are not affected.

This is a stored XSS (CWE-79) in Centreon Web's SNMP traps group configuration module, rated medium at CVSS 4.8. Multiple signals converge on LOW real-world priority rather than an urgent emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) shows the attacker must already hold HIGH privileges (PR:H) to inject the payload and a victim must then interact with the affected page (UI:R); impacts are limited to Low confidentiality and Low integrity with no availability impact, though the scope change (S:C) reflects that the injected script executes in the browser context of other users. EPSS corroborates low urgency at 0.26% (16th percentile), indicating very low probability of exploitation activity. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. No SSVC decision data was provided in the input. The signals are consistent, not conflicting: a high-privilege prerequisite plus required user interaction plus low technical impact plus low EPSS all point the same direction. The main caveat is that PR:H means the attacker is already a privileged/admin-level Centreon operator, so the primary realistic threat model is a malicious or compromised privileged insider escalating against other operators rather than an external unauthenticated attacker.

A Centreon user holding elevated (administrative) privileges saves a malicious JavaScript payload into an SNMP trap group configuration field. When another operator or administrator later opens that configuration page in the Centreon Web UI, the stored script executes in their authenticated browser session, enabling session/data theft or UI actions in their context. No public exploit code was identified for this specific issue at the time of analysis.