CVE-2025-5946CWE-78command-injection

CVE-2025-5946

High · published October 14, 2025

CVSS v3.1
7.2
EPSS
14%
Percentile
96.4
In the wild
Unconfirmed
What it is

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection.

On the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.13508 · 96.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-14T19:16Z
Affected products (3)
ProductVersionsFixed in
centreon/centreon_web≥ 23.10.0, < 23.10.2823.10.28
centreon/centreon_web≥ 24.04.0, < 24.04.1824.04.18
centreon/centreon_web≥ 24.10.0, < 24.10.1324.10.13
References (2)
https://github.com/centreon/centreon/releases · bd4443e6-1eef-43f3-9886-25fc9ceeaae7https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-5946-centreon-web-all-versions-high-severity-5104 · bd4443e6-1eef-43f3-9886-25fc9ceeaae7
EPSS history
Timeline
  • 14 OCT 14:29Z
    RCE via the poller reload feature available only to user with high privilege
    cvelistv5