High severity8.8NVD Advisory· Published Jul 3, 2025· Updated Jul 14, 2026

CVE-2025-34088

Description

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pandorafms/Pandora Fms
cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*
Range: <=7.0_ng
Artica/Pandorafmsllm-fuzzy2 versions
<=7.0NG+ 1 more
- (no CPE)range: <=7.0NG
- (no CPE)range: *

Patches

Vulnerability mechanics

References

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/pandora_ping_cmd_exec.rbnvdExploit
www.exploit-db.com/exploits/48334nvdExploitVDB Entry
vulncheck.com/advisories/pandora-fms-rce-via-pingnvdThird Party Advisory
www.rapid7.com/db/modules/exploit/linux/http/pandora_ping_cmd_exec/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.004
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000