This vulnerability (CVE-2025-34088) affects Pandora FMS versions 7.0NG and earlier. An authenticated user can exploit improper input sanitization in the net_tools.php script's select_ips parameter to inject arbitrary OS commands. The vulnerability arises from the failure to neutralize special elements in user input before passing them to system commands, enabling command injection and remote code execution. The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, and no user interaction required beyond authentication.

Successful exploitation allows an authenticated user to execute arbitrary operating system commands on the server hosting Pandora FMS. This can lead to full compromise of the affected system with the privileges of the authenticated user, potentially impacting confidentiality, integrity, and availability of the system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the available data, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the affected functionality to trusted users only and consider additional application-layer controls to limit command injection risks.