CVE-2025-15029

Critical

Published: 05 January 2026

Published

05 January 2026

Modified

26 January 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.1120 95.4th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-15029 is a critical-severity SQL Injection (CWE-89) vulnerability in Centreon Awie. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-15029 is an improper neutralization of special elements used in an SQL command, classified as an SQL Injection vulnerability (CWE-89), affecting the Awie export modules in Centreon Infra Monitoring. The issue impacts versions from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, and from 24.04.0 before 24.04.3. Published on 2026-01-05, it allows SQL Injection by unauthenticated users.

Unauthenticated attackers can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), in an unchanged impact scope (S:U). Exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), resulting in a CVSS v3.1 base score of 9.8.

Centreon's security advisories, including the bulletin at thewatch.centreon.com and GitHub releases at github.com/centreon/centreon/releases, detail mitigation through upgrading to the fixed versions: 25.10.2, 24.10.3, or 24.04.3.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-0851

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from…

24.04.0 before 24.04.3.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct unauthenticated remote SQL injection in a public-facing web monitoring application (CWE-89) enables initial access via exploitation of the exposed interface.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0