CVE-2025-5946
Last modified
CVE-2025-5946 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.. EPSS estimates a 13.84% chance of exploitation in the next 30 days.
Description
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Centreon | Centreon Web | >= 23.10.0, < 23.10.28 |
| Centreon | Centreon Web | >= 24.04.0, < 24.04.18 |
| Centreon | Centreon Web | >= 24.10.0, < 24.10.13 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-5946?
How severe is CVE-2025-5946?
How do I fix CVE-2025-5946?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59454In Apache CloudStack, a gap in access control checks affecte…4.3
- CVE-2025-59455In JetBrains TeamCity before 2025.07.2 project isolation byp…4.2
- CVE-2025-59456In JetBrains TeamCity before 2025.07.2 path traversal was po…5.5
- CVE-2025-59457In JetBrains TeamCity before 2025.07.2 missing Git URL valid…7.7
- CVE-2025-59458In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66…9.8
- CVE-2025-59459An attacker that gains SSH access to an unprivileged account…7.5
- CVE-2025-59460The system is deployed in its default state, with configurat…7.5
- CVE-2025-59461A remote unauthenticated attacker may use the unauthenticate…9.8
- CVE-2025-59462An attacker who tampers with the C++ CLI client may crash th…7.5
- CVE-2025-59463An attacker may cause chunk-size mismatches that block file …7.5
- CVE-2025-59464A memory leak in Node.js’s OpenSSL integration occurs when c…7.5
- CVE-2025-59465A malformed `HTTP/2 HEADERS` frame with oversized, invalid `…7.5
Are you affected by CVE-2025-5946?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST