CVE-2024-11320

CVE-2024-11320 is a command injection flaw (CWE-77) in the LDAP authentication mechanism of the Pandora FMS monitoring platform, allowing arbitrary commands to be executed on the server. It affects Pandora FMS versions 700 through 777.4 and, per the CVSS 4.0 vector, is reachable over the network with low attack complexity, but requires the attacker to already hold high-privileged (administrator-level) access. Successful exploitation primarily compromises the integrity of the target system through arbitrary command execution, with limited confidentiality and availability impact per the scoring. Only deployments that use LDAP authentication are exposed to this specific flaw. There is no known public proof-of-concept or CISA KEV listing yet, but EPSS assigns a 91% probability of exploitation within 30 days (100th percentile), so defenders should patch promptly despite no confirmed in-the-wild exploitation.

What to do: Upgrade all Pandora FMS deployments running versions 700 through 777.4 to a release newer than 777.4 per the vendor advisory (the available data does not specify a fixed version number). Deployments that cannot patch promptly should verify whether LDAP authentication is enabled and, if so, disable or restrict it (e.g., limit administrative access to trusted sources) since only LDAP-based deployments are exploitable. Administrators should also audit privileged accounts and server logs for signs of unexpected command execution.