Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.4
CVE-2025-8432: Centreon Infra Monitoring lets user run commands as root
CVE-2025-8432 · published 1 year ago
Summary
Versions of Centreon Infra Monitoring (24.10 before 24.10.6, 24.04 before 24.04.9, and 23.10 before 23.10.15) allow a user account on the MBI server to change a script that a scheduled task runs, giving them root privileges. This could let an attacker execute any command on the server. Update to the latest patched version of Centreon Infra Monitoring to close the gap.
Original advisory text
CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON
Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0 before 24.04.9, from 23.10.0 before 23.10.15.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8432.j... Vendor Advisory
- https://github.com/centreon/centreon/releases Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-8432 Vendor Advisory
- https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8432-centreo... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-276Incorrect Default Permissions
Timeline
Published27 Oct 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta