Centreon Web CVE-2025-5946

Requires an authenticated session as a high-privilege (administrative) Centreon user with access to the poller parameters/configuration page; the attacker abuses the poller reload command field by concatenating arbitrary OS instructions (command-injection via unneutralized shell metacharacters). Limiting factors: exploitation is gated on administrative privilege (CVSS PR:H), so it is not reachable by anonymous or low-privilege users; it affects only Centreon Infra Monitoring (Centreon Web) in versions 24.10.0-24.10.12, 24.04.0-24.04.17, and 23.10.0-23.10.27, and no user interaction by a victim is needed since the privileged attacker acts directly.

This is an authenticated OS command injection (CWE-78) in Centreon's poller reload/configuration module. The provided CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) indicates network-reachable, low-complexity exploitation but requires PR:H - a high-privilege (administrative) authenticated account - which is the dominant risk-limiting factor and the reason the score lands at High rather than Critical. The description is consistent with this vector: only a 'user with high privilege' on the poller parameters page can concatenate instructions into the reload command. EPSS is notably elevated at 13.51% (96th percentile), unusually high for a flaw that gates on administrative privilege; this likely reflects the triviality of exploitation ONCE authenticated and attacker interest in monitoring platforms, rather than mass unauthenticated opportunity - treat the EPSS as a signal of exploitability, not of unauthenticated internet-wide scanning. This CVE is NOT in CISA KEV and no public exploit is referenced, so the EPSS percentile and the KEV/POC signals diverge: high modeled probability but no confirmed in-the-wild use. Net: a real priority for organizations running affected Centreon versions, because a compromised or abusive admin account yields full OS-level command execution on the monitoring server, but it is a privilege-dependent issue, not a remote unauthenticated takeover. No SSVC decision data was supplied in the input, so automatable/technical-impact framing cannot be quoted as vendor fact.

An attacker who already holds (or has compromised/phished) a high-privilege Centreon administrative account logs into the web interface, navigates to the poller parameters page, and appends shell metacharacters and custom commands to the poller reload configuration field. When the reload command executes, the injected commands run with the privileges of the Centreon/poller service account, giving the attacker arbitrary OS command execution on the monitoring host. No public exploit code is referenced, but the technique is straightforward for anyone with the required privileged access.