CVE-2014-125124: critical vulnerability in Artica ST Pandora FMS
Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 10epss 2.4%
from disclosure to weaponsame day
Published on NVDJul 31
metasploitJan 29
An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell command, allowing arbitrary command execution as the pandora user. In certain versions (notably 4.1 and 5.0RC1), the pandora user can elevate privileges to root without a password using a chain involving the artica user account. This account is typically installed without a password and is configured to run sudo without authentication. Therefore, full system compromise is possible without any credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Artica ST · Pandora FMSpublic PoCs found — 2
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/pandora_fms_exec.rbunverifiedcve_referencewww.exploit-db.com/exploits/31518unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Artica ST Pandora FMS
In the same product, most dangerous first.