CVE-2022-42424: Centreon poller broker config SQL injection privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityAuthenticated SQL injection leading to full administrative takeover, with a very high EPSS score but no confirmed in-the-wild exploitation or KEV listing.

What it is

Centreon fails to validate a user-supplied string before building SQL queries when handling requests to modify poller broker configuration. An authenticated attacker can inject SQL through that path and escalate their privileges to administrator. The flaw is a classic CWE-89 SQL injection in a monitoring platform, so a low-privileged account can take over the application.

Impact

An attacker with a valid low-privileged account gains administrator-level control of the Centreon installation. That includes the ability to change monitoring configuration and potentially pivot to managed hosts.

Attack surface

Reachable over the network through the poller broker configuration request path (AV:N, AC:L). Authentication is required (PR:L) and no user interaction is needed (UI:N).

Exploitation

Not listed in CISA KEV and no ransomware use documented. EPSS is very high at 0.761 (99.5th percentile), and the only references are the ZDI advisory, so no public exploit code is confirmed by this record.

What to do

• Apply the Centreon fix for CVE-2022-42424 as soon as a patched release is available; the record does not name affected or fixed versions, so confirm with the vendor advisory.
• Restrict access to the Centreon web interface to trusted management networks and require strong authentication.
• Review and minimize accounts with poller broker configuration rights, and audit for unexpected administrator accounts.
• Monitor Centreon and its database for anomalous configuration changes and unexpected SQL activity.

Detection

• Audit Centreon logs for poller broker configuration modification requests from unusual accounts or IPs.
• Search database logs for SQL errors or injected syntax tied to Centreon configuration queries.
• Alert on new or modified administrator accounts in Centreon.
• Baseline normal poller broker configuration changes and flag deviations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.