CVE-2025-15029

Critical

Published: 05 January 2026

Published

05 January 2026

Modified

26 January 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0004 12.0th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-15029 is a critical-severity SQL Injection (CWE-89) vulnerability in Centreon Awie. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires timely patching and updating of vulnerable software, directly addressing this SQL injection flaw by upgrading to fixed Centreon versions.

SI-10 Information Input Validation good match

prevent

Mandates validation of information inputs to neutralize special elements, preventing SQL injection exploitation in the Awie export modules.

RA-5 Vulnerability Monitoring and Scanning partial match

detectrespond

Vulnerability scanning detects SQL injection flaws like CVE-2025-15029 in affected applications, enabling remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct unauthenticated remote SQL injection in a public-facing web monitoring application (CWE-89) enables initial access via exploitation of the exposed interface.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from…

24.04.0 before 24.04.3.

Deeper analysisAI

CVE-2025-15029 is an improper neutralization of special elements used in an SQL command, classified as an SQL Injection vulnerability (CWE-89), affecting the Awie export modules in Centreon Infra Monitoring. The issue impacts versions from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, and from 24.04.0 before 24.04.3. Published on 2026-01-05, it allows SQL Injection by unauthenticated users.

Unauthenticated attackers can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), in an unchanged impact scope (S:U). Exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), resulting in a CVSS v3.1 base score of 9.8.

Centreon's security advisories, including the bulletin at thewatch.centreon.com and GitHub releases at github.com/centreon/centreon/releases, detail mitigation through upgrading to the fixed versions: 25.10.2, 24.10.3, or 24.04.3.