CVE-2024-23117: Centreon updateContactServiceCommands SQL injection leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.2 with network reachability and code execution impact, plus a very high EPSS percentile, outweighs the authentication prerequisite.

What it is

Centreon's updateContactServiceCommands function fails to validate user-supplied input before building SQL queries, creating a SQL injection flaw. Because the injected query can be leveraged to run code, an authenticated attacker can achieve remote code execution on the Centreon installation. The issue is tracked as ZDI-CAN-22297 and has a patch reference.

Impact

An attacker who can reach the vulnerable function gains code execution in the context of the service account, giving them control over the Centreon host and its monitoring data.

Attack surface

The flaw is network-reachable (AV:N) with no user interaction (UI:N), but requires high privileges (PR:H), meaning the attacker must already hold an authenticated account with the rights to invoke updateContactServiceCommands.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.53 (98.9th percentile), and the only references are the ZDI advisory tagged Patch and Third Party Advisory, so no public exploit code is confirmed in the record.

What to do

• Apply the vendor patch referenced in ZDI-24-115 as soon as possible.
• Restrict and audit accounts that can call updateContactServiceCommands; enforce least privilege on Centreon administrative roles.
• Use parameterized queries or input validation for any custom code touching this function.
• Segment the Centreon host and limit outbound access from the service account to reduce post-exploitation reach.

Detection

• Monitor Centreon application and database logs for anomalous SQL syntax or errors originating from updateContactServiceCommands.
• Alert on unexpected child processes or command execution spawned by the Centreon service account.
• Review authentication logs for use of high-privilege accounts outside normal administrative windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.