CVE-2025-5306

Pandora FMS versions 774 through 778 fail to properly neutralize special characters in the directory field of the Netflow feature, which allows OS command injection (CWE-77). An attacker who already holds high-privilege (administrative) access to the Pandora FMS console over the network can submit a crafted directory value, causing arbitrary operating system commands to run on the monitoring server. Successful exploitation yields a high integrity impact (full system modification and a shell-level foothold on the server), with low confidentiality and availability impact per the CVSS scoring. Organizations running affected Pandora FMS builds are affected, particularly those with internet-exposed consoles where an admin account compromise could be escalated to server-level control. No public proof-of-concept or in-the-wild exploitation is known yet, but the EPSS score of 32% (98th percentile) indicates a meaningful probability of exploitation attempts within the next 30 days.

What to do: Upgrade Pandora FMS to a release newer than build 778, checking Artica's security advisory for the specific fixed build. Until patched, restrict permission to modify Netflow settings to trusted administrators only and keep the console off the public internet or behind a VPN. Because exploitation requires high-privileged access, review recent activity on administrator accounts and enforce MFA and password rotation for console admins.