by Kastro
Paper/Archive/CVE-2025-5306

CVE-2025-5306

Pandora FMS Pandora FMS — Command Injection in Netflow path

EPSS 36%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.5.985 × 2019.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778

Affected

ProductAffectedFixed inSource
Pandora FMS774 – 778–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PandoraFMS (CNA)7.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/S:N/AU:N/R:U/V:D/RE:M/U:Green
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refpandorafms.com/en/security/common-vulnerabilities-and-exposures