This vulnerability (CVE-2025-34088) affects Pandora FMS by Artica ST, specifically in versions 7.0NG and earlier. The issue is due to improper neutralization of special elements in the select_ips parameter used in net_tools.php, which is responsible for network tool operations like ping. Because user input is not properly sanitized before being passed to system commands, authenticated users can perform OS command injection, leading to remote code execution. The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

An authenticated attacker can execute arbitrary operating system commands on the server running Pandora FMS by exploiting the unsanitized select_ips parameter in net_tools.php. This can lead to full compromise of the affected system, including unauthorized access, data manipulation, or service disruption. The vulnerability impacts confidentiality, integrity, and availability of the system with high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Pandora FMS to trusted users only and monitor for suspicious activity related to network tool operations. Avoid exposing the management interface to untrusted networks. Follow up with Artica ST for updates on patches or official mitigations.