CVE-2025-34088
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php script fails to sanitize the select_ips parameter before passing it to system commands, allowing command injection.
Risk Assessment
An authenticated attacker can gain full control over the Pandora FMS server, execute arbitrary commands, modify data, or disrupt monitored IT infrastructure.
Recommendation
Upgrade Pandora FMS to a version later than 7.0NG immediately. Restrict administrative interface access to trusted users until the patch is applied.
Original NVD description (English source)
An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.