CVE-2024-12971
HIGHPandora FMS authenticated command injection leading to RCE via chromium_path or phantomjs_bin
Title source: metasploitDescription
Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6
Exploits (1)
metasploit
WORKING POC
EXCELLENT
rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_12971.rb
Scores
CVSS v3
8.8
EPSS
0.8191
EPSS Percentile
99.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-77
Status
published
Products (1)
artica/pandora_fms
700 - 777.8
Published
Mar 17, 2025
Tracked Since
Feb 18, 2026