Read the docs
TI-2025-07718 Aliases CVE-2025-8432GHSA-qq2g-5gj7-w9xg

CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON

Priority LOW 37CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0 before 24.04.9, from 23.10.0 before 23.10.15.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed Infra Monitoring (Centreon): 24.10.6, 24.04.9, 23.10.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CentreonInfra Monitoring24.10.0 to before 24.10.6; 24.04.0 to before 24.04.9; 23.10.0 to before 23.10.1524.10.6, 24.04.9, 23.10.15Patch availableCNA
  • Infra Monitoring VendorCentreon Affected 24.10.0 to before 24.10.6; 24.04.0 to before 24.04.9; 23.10.0 to before 23.10.15 Fixed in 24.10.6, 24.04.9, 23.10.15 Patch available CNA

Remediation

  • Fix · CNA Infra Monitoring (Centreon) Fixed in 24.10.6, 24.04.9, 23.10.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-8432
  2. 2026-10-03 Alias added: GHSA-qq2g-5gj7-w9xg

References

Advisory 1

Other 1

See all 130 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences