CVE-2025-8432

CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON

State: Published
Severity: 8.4 High
Published: Oct 27, 2025
Updated: Oct 30, 2025
Reserved: Jul 31, 2025

Description

Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0 before 24.04.9, from 23.10.0 before 23.10.15.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H	Centreon

Weaknesses

CWE-276 Incorrect Default Permissions

Affected Products

Product	Versions
Infra MonitoringCentreon	24.10.0 to before 24.10.6Affected 24.04.0 to before 24.04.9Affected 23.10.0 to before 23.10.15Affected

References

https://github.com/centreon/centreon/releasesrelease-notes
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8432-centreon-mbi-high-severity-5180vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.