Vulnerability record · CVE-2014-3829 · published 23 October 2014
CVE-2014-3829: Centreon displayServiceStatus.php command injection via session_id and template_id
Merethis · Centreon
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 passes the session_id and template_id parameters into a command_line variable without sanitizing shell metacharacters. An unauthenticated remote attacker can therefore inject and execute arbitrary operating system commands. The flaw is fixed in Centreon web 2.5.3.
Description
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote command execution with a CVSS 2.0 score of 10 and very high EPSS probability, with public exploit references available.
What it is
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 passes the session_id and template_id parameters into a command_line variable without sanitizing shell metacharacters. An unauthenticated remote attacker can therefore inject and execute arbitrary operating system commands. The flaw is fixed in Centreon web 2.5.3.
Impact
An attacker gains arbitrary command execution on the Centreon server, which typically runs with the web server's privileges and can lead to full compromise of the monitoring host and its managed infrastructure.
Attack surface
Reachable over the network through HTTP requests to displayServiceStatus.php; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
No CISA KEV listing, but EPSS is 0.80243 (99.6th percentile) and public references are tagged Exploit, indicating exploit code is publicly available and exploitation is likely.
What to do
- Upgrade to Centreon web 2.5.3 or later, which contains the fix.
- If immediate upgrade is not possible, restrict network access to displayServiceStatus.php and the Centreon web interface to trusted management networks.
- Apply the upstream commit cc2109804dd69057cb209037113796ec5ffdce90 if maintaining a patched fork.
- Run the Centreon web service under a least-privilege account and review file and command execution permissions.
- Monitor and audit the Centreon host for unexpected child processes spawned by the web server.
Detection
- Inspect web server and Centreon logs for requests to displayServiceStatus.php containing shell metacharacters (;, |, &, $(), backticks) in session_id or template_id.
- Alert on unexpected child processes spawned by the web server or PHP process on Centreon hosts.
- Search for outbound connections or command execution artifacts originating from the Centreon server shortly after such requests.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-3829 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-3829), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
