Centreon MBI CVE-2025-8432

Exploitation requires the attacker to already possess or control the CentreonBI user account on the Centreon MBI (Monitoring Business Intelligence) module server - this is the specific prerequisite named in the description. The affected feature is the MBI reporting/script engine, where incorrect default permissions let the CentreonBI account embed scripts within other scripts. Exploitation is further limited by the need for user interaction (UI:R per CVSS) to trigger execution of the tampered script, and it only applies to deployments that have the MBI add-on modules installed (not base Centreon). Limiting factors: high-privilege account control, MBI module deployment, and script execution trigger - all of which constrain this to insider/compromised-service-account abuse rather than opportunistic remote attacks.

This is a CVSS 8.4 (High) flaw whose real-world priority is materially lower than the raw score suggests once all signals are weighed. The CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) is driven to High primarily by the scope change (S:C) and full C/I/A impact, but it explicitly requires HIGH privileges (PR:H) and user interaction (UI:R) - the attacker must already control the privileged CentreonBI service account on the MBI server, so this is a privilege-escalation/abuse-of-trust issue rather than a pre-auth remote compromise. EPSS corroborates the lower urgency: 0.43% probability at the 35th percentile indicates low near-term exploitation likelihood. The CVE is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was provided in the input. Note a tension worth flagging: the vendor assigns AV:N, yet the root cause (Incorrect Default Permissions, CWE-276, abused by a local service account embedding scripts within scripts on the MBI server) reads as a local/config-bound condition - verify the true attack vector with Centreon before treating this as remotely reachable. Overall: patch in normal cycle for Centreon MBI operators, but it is not an emergency unless the CentreonBI account is exposed or shared.

An actor who has obtained the privileged CentreonBI service account on the Centreon MBI (Business Intelligence) server leverages incorrect default permissions to embed arbitrary scripts within legitimate reporting scripts. When those scripts are executed (user interaction), the embedded code runs in the trusted BI context, enabling code execution and privilege escalation beyond the account's intended scope. No public exploit code is referenced for this CVE.