CVE-2024-12992CWE-77

Remote Code Execution leads to Command Injection

High · published March 17, 2025

CVSS v4.0
8.6
EPSS
1%
Percentile
68.1
In the wild
Unconfirmed
What it is

⚡ A tiny miscommunication in Pandora FMS could let attackers run commands on your system directly! 🚨 Think of it like a restaurant that allows customers to send special instructions without checking if they’re safe — one rogue order could lead to chaos in the kitchen! 🍽️ An attacker could exploit this vulnerability to execute arbitrary commands on the server, potentially leading to unauthorized access, data breaches, or even complete takeover of the system. It’s like giving someone the master key to your organization — absolutely devastating! 🔥

Put simply

Think of it like a restaurant that allows customers to send special instructions without checking if they’re safe — one rogue order could lead to chaos in the kitchen! 🍽️ This vulnerability arises due to improper handling of special characters in commands, allowing remote code execution (RCE) through crafted inputs. It affects versions 700 to 777.6 of Pandora FMS.

What to do

An attacker could exploit this vulnerability to execute arbitrary commands on the server, potentially leading to unauthorized access, data breaches, or even complete takeover of the system. It’s like giving someone the master key to your organization — absolutely devastating! 🔥 To protect your systems, patch Pandora FMS to version 777.7 or higher immediately. Review your input validation mechanisms to ensure they properly neutralize special characters. Don’t forget to audit your configurations to close any loopholes! 🛡️ You've got this! With these steps, you'll be locking down your security like a pro! 💪✨

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
EPSS
0.01205 · 68.1th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-03-17T09:21Z
EPSS history
Timeline
  • 17 MAR 09:21Z
    Remote Code Execution leads to Command Injection
    cvelistv5