PT-2026-1258 · Centreon · Centreon Infra Monitoring

H00Die-Gr3Y · Publicado 2026-01-05 · Atualizado 2026-01-26 · CVE-2025-5965

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Centreon Infra Monitoring versions 25.10.0 through 25.10.1 Centreon Infra Monitoring versions 24.10.0 through 24.10.14 Centreon Infra Monitoring versions 24.04.0 through 24.04.18

Description A flaw exists in the backup parameters of Centreon Infra Monitoring where a user with high privileges can append custom instructions to the backup configuration. This can lead to OS Command Injection due to improper neutralization of special elements used in OS commands. The issue is present in the backup configuration within the administration setup modules.

Recommendations Update Centreon Infra Monitoring to version 25.10.2 or later. Update Centreon Infra Monitoring to version 24.10.15 or later. Update Centreon Infra Monitoring to version 24.04.19 or later.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2025-5965

Produtos afetados

Centreon Infra Monitoring

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5965.json · Exploit
• https://github.com/centreon/centreon/releases · Nota
• https://twitter.com/cracbot/status/2009943363278217646 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2008129299685998909 · Publicação no Twitter
• https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-5965-centreon-web-high-severity-5362 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-5965 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-5965 · Nota de Segurança
• https://t.me/cveNotify/149874 · Publicação no Telegram