CVE-2025-34088
Pandora FMS Authenticated Remote Code Execution via Ping Module
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.
Existe una vulnerabilidad de ejecución remota de código autenticado en Pandora FMS versión 7.0NG y anteriores. La función net_tools.php permite a los usuarios autenticados ejecutar comandos arbitrarios del sistema operativo mediante el parámetro select_ips al realizar operaciones con herramientas de red, como hacer ping. Esto se debe a que la entrada del usuario no se depura correctamente antes de pasarla a los comandos del sistema, lo que permite la inyección de comandos.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2025-04-15 CVE Reserved
- 2025-07-03 CVE Published
- 2025-07-03 CVE Updated
- 2025-07-03 First Exploit
- 2025-07-04 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
- CAPEC-88: OS Command Injection
- CAPEC-137: Parameter Injection
References (5)
URL | Tag | Source |
---|---|---|
https://github.com/pandorafms/pandorafms | Product | |
https://vulncheck.com/advisories/pandora-fms-rce-via-ping | Third Party Advisory | |
https://www.rapid7.com/db/modules/exploit/linux/http/pandora_ping_cmd_exec | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/pandora_ping_cmd_exec.rb | 2025-07-03 | |
https://www.exploit-db.com/exploits/48334 | 2025-07-03 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Artica ST Search vendor "Artica ST" | Pandora FMS Search vendor "Artica ST" for product "Pandora FMS" | <= 7.0NG Search vendor "Artica ST" for product "Pandora FMS" and version " <= 7.0NG" | en |
Affected
|