Which versions of Pandora Fms are affected by CVE-2024-12971?

Organizations using Improper Neutralization of Special Elements used in a Command vulnerability face significant risk from CVE-2024-12971, a command injection vulnerability rated CVSS 8.6.

Is there a public PoC exploit available for CVE-2024-12971?

Yes, a public proof-of-concept exploit is available for CVE-2024-12971. Prioritise patching immediately. EPSS: 73.6%.

How to fix or mitigate CVE-2024-12971?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Pandora Fms CVE-2024-12971

Q: What is the CVSS score of CVE-2024-12971?

CVE-2024-12971 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Green. EPSS exploitation probability: 73.6%.

HIGH

Command Injection (CWE-77)

2025-03-17 security@pandorafms.com

Command Injection Pandora Fms Artica

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Green

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:31 vuln.today

CVE Published

Mar 17, 2025 - 10:15 nvd

HIGH 8.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6

AnalysisAI

Pandora FMS monitoring platform versions 700 through 777.6 contain a command injection vulnerability that allows OS command execution. The improper neutralization of special elements in monitoring agent communication enables attackers to execute arbitrary commands on the Pandora FMS server with the application's privileges.

Technical ContextAI

Pandora FMS processes data from monitoring agents through various API endpoints. Special characters in agent data fields are not properly neutralized before being used in system commands. An attacker who can control or spoof agent communication can inject OS commands that execute on the Pandora FMS server.

RemediationAI

Update Pandora FMS to a version beyond 777.6. Implement agent authentication to prevent rogue agent registration. Sanitize all agent-provided data before shell processing. Segment the monitoring network from production systems.