CVE-2025-34088

HIGH

Pandora FMS <7.0NG - Command Injection

Title source: llm

Description

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/48334
metasploit WORKING POC EXCELLENT
by Onur ER <[email protected]> · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_ping_cmd_exec.rb

References (5)

Scores

CVSS v3 8.8
EPSS 0.4971
EPSS Percentile 97.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-78
Status published

Affected Products (1)

pandorafms/pandora_fms < 7.0_ng

Timeline

Published Jul 03, 2025
Tracked Since Feb 18, 2026