RCE in Centreon Centreon_web
CVE-2025-5946
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.138 (96.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Centreon Centreon_web
- Centreon Infra Monitoring — versions 24.10.0, 24.04.0, 23.10.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- bd4443e6-1eef-43f3-9886-25fc9ceeaae7 (release-notes, Release Notes)
- bd4443e6-1eef-43f3-9886-25fc9ceeaae7 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-5946?
- CVE-2025-5946 is a high-severity vulnerability in Centreon Centreon_web, classified under OS Command Injection. CVSS score: 7.2/10. Published 2025-10-14.
- How severe is CVE-2025-5946?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2025-5946 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.