Pandora FMS EUVD-2026-29496

Successful exploitation requires the Pandora FMS web interface to accept session identifiers from external sources (URL parameters or cookies) without regeneration on authentication. The attack requires user interaction (UI:P in CVSS vector) - specifically, a legitimate user must click an attacker-supplied link or visit an attacker-controlled page that sets session cookies before authenticating to Pandora FMS. Attack requirements present (AT:P) suggests the application must be in a specific state or configuration that accepts external session IDs, likely related to session handling implementation in versions 777-800. No authentication required by the attacker (PR:N), but the victim must have valid Pandora FMS credentials. Exploitation is limited by the need to socially engineer target users into using attacker-supplied session tokens before login, making this impractical for mass exploitation but effective in targeted campaigns against high-value administrator accounts.

Real-world risk is moderate to high for internet-facing Pandora FMS installations. CVSS 7.6 reflects high confidentiality and integrity impact (VC:H/VI:H) requiring network access and user interaction but no privileges. However, AT:P (attack requirements present) suggests specific conditions must exist beyond simple network reachability. Not present in CISA KEV, indicating no confirmed widespread exploitation. No EPSS data provided, but session fixation historically shows low exploitation rates compared to RCE due to social engineering requirements. SSVC decision: exploitation status unknown, automatable is no (requires UI:P), technical impact is high (session hijacking grants full user privileges). This is a prioritization candidate for organizations with exposed Pandora FMS instances accessible to untrusted networks, especially if administrator accounts can be targeted. Risk lower for internal-only deployments with strict access controls, though lateral movement scenarios remain concerning.

Attacker crafts a Pandora FMS login URL containing a pre-set session identifier (e.g., https://target.example.com/pandora_console/index.php?login_page=1&PHPSESSID=attackercontrolledtoken) and delivers it to a target administrator via phishing email or watering-hole attack. When the administrator clicks the link and successfully authenticates, Pandora FMS fails to regenerate the session ID, binding the attacker-controlled token to the now-authenticated session. The attacker then uses the known session identifier to hijack the administrator's session, gaining full access to network monitoring data, device credentials, and administrative functions without further authentication.