Cyber Resilience

CVE-2025-5946

HighRCE

Published: 14 October 2025

Published
14 October 2025
Modified
22 October 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.3233 97.0th percentile
Risk Priority 34 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-5946 is a high-severity OS Command Injection (CWE-78) vulnerability in Centreon Centreon Web. Its CVSS base score is 7.2 (High).

Operationally, ranked in the top 3.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2025-5946 is an OS command injection vulnerability (CWE-78) in Centreon Infra Monitoring that affects the poller reload setup within the configuration modules. On the poller parameters page, insufficient neutralization of special elements allows an attacker to inject commands into the reload process. The flaw impacts versions 24.10.0 through 24.10.12, 24.04.0 through 24.04.17, and 23.10.0 through 23.10.27, and carries a CVSS 3.1 score of 7.2.

A user with high privileges can exploit the issue over the network by appending arbitrary instructions to the poller reload command, resulting in execution of operating system commands with the potential for full compromise of confidentiality, integrity, and availability on the affected host.

Centreon has published fixes in the referenced GitHub releases and security bulletin, which address the affected branches by updating to 24.10.13, 24.04.18, and 23.10.28 or later. The current EPSS score of 0.3233 with a peak of 0.3379 does not indicate a material rise from a low baseline.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a user with high privilege is…

more

able to concatenate custom instructions into the poller reload command. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

centreon
centreon web
23.10.0 — 23.10.28 · 24.04.0 — 24.04.18 · 24.10.0 — 24.10.13

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References