External risk intelligence

Centreon Awie SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-15029

Centreon Infra Monitoring and its modules are typically deployed as infrastructure management and monitoring platforms. These services are commonly accessible via web interfaces to allow administrators to monitor networks and systems, making them frequently exposed as edge or internal management services reachable over the network.

SQL Injection

Centreon Awie

24.04.0 to before 24.04.324.10.0 to before 24.10.325.10.0 to before 25.10.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Centreon Infra Monitoring's export modules could allow an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to unauthorized access and modification of sensitive data. This affects how the system manages and monitors infrastructure. The main concern is confirming relevance and exposure to our environment.

Unauthenticated attackers can inject malicious SQL commands.
Confirms relevance and exposure is the primary leadership action.
Protects data integrity and system availability.

Attack Path

How an attacker could exploit the issue

An unauthenticated user can exploit a flaw in Centreon's Awie export modules by sending specially crafted input. This input can then be used to manipulate database queries, potentially leading to unauthorized access to sensitive information or modifications within the monitoring system.

No authentication required.
Manipulated input in export functions.
Potential for data compromise or alteration.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated user to inject malicious SQL commands into the Awie export modules of Centreon Infra Monitoring. When supported by the advisory, this could affect the integrity and availability of the underlying database, potentially leading to unauthorized data access or modification.

Database integrity and availability at risk.
SQL injection through unauthenticated network access.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Centreon's Awie export modules requires a coordinated response. Infrastructure or platform teams responsible for Centreon deployments should first identify all instances of the affected Awie modules, confirm their network reachability and criticality, and then assign ownership for remediation. Planning for the first practical fix or mitigation should then commence based on the identified risk.

Infrastructure/Platform teams own the issue.
Verify Awie module instances and exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Centreon Awie and why is it used?

Centreon Awie is a component within the Centreon Infra Monitoring platform, specifically serving as an export module. These modules are used to facilitate the extraction and movement of data collected by the monitoring system, which administrators rely on to track the health and performance of their IT infrastructure.

How does CVE-2025-15029 represent a SQL injection vulnerability?

CVE-2025-15029 is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. This means the software fails to properly filter user-provided input before using it in database queries. An attacker can supply malicious SQL code as input, tricking the database into executing unauthorized commands rather than processing the intended data.

What triggers this SQL injection flaw in the Awie module?

The vulnerability is triggered when an attacker sends specially crafted, malicious input to the Awie export module. Because the flaw exists within the module's processing logic, it is the input itself that initiates the exploit. Standard, legitimate use of the export functionality does not trigger this security weakness.

How should I assess if my systems are at risk?

According to Halo Surface Signal, Centreon Infra Monitoring services are often deployed as web-accessible management platforms. Because they are frequently reachable over a network, you should check if your specific instance of the Awie module is accessible to users on your network or the internet. If the service is reachable, it faces a higher likelihood of being targeted.

Do I need to take action if I am running an affected version?

Yes, you should prioritize identifying all instances of the Awie module currently running in your environment. Once you have located these instances and confirmed their network accessibility, you should move to plan your remediation steps, which involves ensuring your systems are updated to the secure versions listed in the vendor's security bulletin.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.