CVE-2024-12971

CVE-2024-12971 is an OS command injection flaw (CWE-77) in Artica Pandora FMS in which improperly neutralized special elements in user-supplied input allow arbitrary operating system commands to be run on the monitoring server. It is triggered through Pandora FMS functionality that passes input into OS commands, and the CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N) indicates exploitation requires network access and a high-privilege (admin-level) account, but no user interaction. A successful attacker gains command execution on the host with high confidentiality and integrity impact on the vulnerable component, typically meaning broad read/write access to monitoring data and the underlying system. Any organization running Pandora FMS versions 700 through 777.6 is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, but EPSS assigns a 60.6% probability of exploitation within 30 days (99th percentile), so attackers may target it soon.

What to do: Upgrade Pandora FMS to a current release later than 777.6, which addresses this flaw. Until patched, restrict console and admin-level access to trusted networks and audit for unauthorized or dormant administrator accounts, since high privileges are required for exploitation. Monitor vendor advisories from Artica for the exact fixed release.