External risk intelligence

Centreon Awie Module Missing Authentication Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-15026

Centreon is a network and infrastructure monitoring platform. While such platforms are often deployed within internal networks, they may be exposed to the internet in certain environments to monitor remote assets or provide access to distributed teams, making internet reachability possible but not inherently guaranteed as a design requirement for this specific module.

Missing Authentication

Centreon Awie

24.04.0 to before 24.04.324.10.0 to before 24.10.325.10.0 to before 25.10.2

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Centreon's Awie import module could allow unauthorized access to critical functions, potentially impacting the integrity and availability of monitoring data. The issue lies in a failure to properly check user permissions for certain operations within the module. Its potential for broad impact necessitates a review of our Centreon deployment to confirm relevance and exposure.

Unauthenticated access to critical monitoring functions.
This affects system integrity and data availability.
Review Centreon Awie for exposure and relevance.

Attack Path

How an attacker could exploit the issue

An attacker can access a sensitive import functionality within Centreon's Awie module without needing to log in. This exposure allows them to manipulate data or potentially disrupt monitoring operations, depending on the precise capabilities of the import function when improperly accessed.

No authentication required to access.
Triggered by interacting with the import feature.
Leads to unauthorized access and potential disruption.

Live Threat

Current exploitation, exposure, and threat context

The Awie import module in Centreon Infra Monitoring, when unauthenticated, could allow unauthorized access to critical functions. This could potentially lead to the modification or deletion of monitoring data or system configurations, impacting the integrity and availability of the monitoring service.

Monitoring data and system configurations.
Unauthenticated access to critical functions.
Disruption of infrastructure monitoring services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Centreon's Awie import module requires immediate attention from the infrastructure and security teams responsible for managing Centreon deployments. The first practical step is to identify all instances of the affected Awie module, determine their network exposure and business criticality, and locate the accountable system owner. Remediation planning should then proceed based on the assessed risk and operational impact.

Infrastructure and platform teams should own the issue.
Verify network exposure and business criticality first.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Centreon Awie module?

Centreon is a platform used to monitor IT infrastructure performance and availability. The Awie module within Centreon specifically handles data import tasks, allowing administrators to bring external information into the monitoring system. Because this module interacts with configuration and monitoring data, it is a key component for managing how the system tracks network health and performance.

What does CVE-2025-15026 mean by missing authentication?

This vulnerability is classified as CWE-306, which means the software fails to verify the identity of a user before allowing them to perform sensitive actions. In the context of the Awie module, it means the system does not require a valid login to access critical import functions. Consequently, an unauthorized party could potentially interact with these features as if they were a legitimate, authenticated administrator.

How is this vulnerability triggered?

The flaw is triggered when an attacker interacts directly with the affected import functionality in the Awie module. Because the system lacks a proper permission check, the request is processed without verifying if the user has authorization. Simply browsing the main Centreon interface or using standard monitoring dashboards that do not invoke these specific import routines does not trigger the vulnerability.

Do I need to worry if my Centreon instance is internal?

According to Halo Surface Signal, this vulnerability is considered external due to the network-based attack vector. While Centreon is often hosted on internal networks, any instance reachable from the internet significantly increases risk. Even if your installation is internal, you should assess if the module is active, as the severity of the flaw impacts the integrity of your monitoring data regardless of the network perimeter.

When should I prioritize updating my Awie module?

You should prioritize this immediately if you are running an affected version of the Centreon Infra Monitoring suite. Start by auditing your environment to locate all active Awie modules and confirm their version numbers against the affected range. Once identified, consult the official Centreon security bulletins and release notes to coordinate the necessary updates with your infrastructure team to restore proper authentication controls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.