CVE-2024-0637: Centreon updateDirectory SQL injection leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and full confidentiality, integrity and availability impact, plus a very high EPSS score, though exploitation requires an authenticated account and no KEV listing or public exploit is confirmed.

What it is

Centreon's updateDirectory function fails to validate a user-supplied string before building SQL queries, creating a SQL injection flaw. Because the injected query can be leveraged to run code as the service account, it turns a database injection into remote code execution on the Centreon installation.

Impact

An authenticated attacker can execute arbitrary code in the context of the Centreon service account, giving full control over the application's data and the host processes that account can reach.

Attack surface

Reachable over the network through the Centreon web interface with the CVSS vector AV:N/AC:L/PR:L/UI:N, so a low-privileged authenticated account is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at 0.723 (99.4th percentile), indicating strong predicted exploitation activity; the only references are the ZDI advisory tagged Patch and Third Party Advisory, with no public exploit reference supplied.

What to do

• Apply the vendor patch referenced by the ZDI advisory ZDI-24-118 as soon as possible.
• Restrict access to the Centreon web interface to trusted management networks and remove or disable unused accounts.
• Enforce least privilege on the Centreon service account so code execution does not reach broader systems.
• Review Centreon accounts and audit logs for unexpected or newly created privileged users.
• Monitor vendor channels for updated Centreon releases and re-check exposure after patching.

Detection

• Search Centreon and web server logs for SQL metacharacters or unusual query strings sent to the updateDirectory endpoint.
• Alert on unexpected child processes spawned by the Centreon web or service account, especially shells or command interpreters.
• Monitor database logs for malformed or error-generating queries originating from the Centreon application.
• Baseline normal Centreon web request patterns and flag anomalous request volumes or payloads from authenticated sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.