Centreon Web CVE-2025-8430

Requires an authenticated user with elevated/administrative privileges (PR:H) who can write to the Commands Connectors configuration modules of Centreon Infra Monitoring (Centreon Web) to store the malicious payload. Exploitation is further gated by required user interaction (UI:R): a second user must subsequently load the affected configuration page for the stored script to execute. Limiting factors that reduce real-world risk: the high-privilege barrier to plant the payload, the need for victim interaction, and that only specific affected version ranges (24.10.0-24.10.12, 24.04.0-24.04.17, 23.10.0-23.10.27) are vulnerable. No availability impact.

This is a genuinely low-priority, medium-severity issue rather than an urgent one, and the signals are consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base 4.8) describes a stored XSS that requires a high-privilege authenticated account to plant the payload and a second user's interaction to trigger it, with only low confidentiality and integrity impact and no availability impact. EPSS reinforces this: 0.21% probability at the 10th percentile indicates very low expected real-world exploitation. The vulnerability is NOT on the CISA KEV list (no confirmed active exploitation) and there is no public exploit identified at time of analysis, so this is theoretical risk only. No signals conflict - the high-privilege prerequisite (PR:H), required user interaction (UI:R), and low EPSS all point the same direction. The main caveat is that the elevated-privilege requirement means the attacker is already a trusted administrator, so realistic impact is largely limited to privilege-escalation-adjacent or insider/compromised-admin scenarios; the scope change (S:C) reflects that injected script executes in other users' browser sessions.

An attacker who already holds an elevated/administrative Centreon Web account injects a malicious script into the Commands Connectors configuration fields. When another authenticated user later views that configuration page, the stored payload executes in their browser session (UI:R), potentially stealing session data or performing actions as that user. No public exploit code is known, and the high-privilege prerequisite makes this most relevant to compromised-admin or insider scenarios.