CVE-2025-34088

Deeper analysis

An authenticated remote code execution vulnerability affects Pandora FMS version 7.0NG and earlier. The flaw resides in the net_tools.php component, where the select_ips parameter used for network diagnostic operations such as ping is passed to system commands without adequate sanitization. This permits command injection, tracked as CWE-78, and carries a CVSS 4.0 score of 8.6 reflecting network-accessible exploitation by a high-privileged authenticated user with no user interaction required.

An attacker who already possesses valid administrative credentials can supply a crafted select_ips value to execute arbitrary operating-system commands on the underlying host. Successful exploitation grants full control over confidentiality, integrity, and availability of the monitored system, enabling actions such as data exfiltration, persistence installation, or lateral movement within the environment.

Public exploit code is available, including a Metasploit module and an Exploit-DB entry that demonstrate the injection vector. The associated EPSS score currently stands at 0.7412 with an identical recorded peak, indicating sustained exploitation interest following disclosure.