CVE-2023-44092 is a high severity (CVSS 7.6) OS command injection in Pandora FMS from version 700 up to but not including 776. The vendor says it allowed a reverse shell and command execution on the host. Version 776 is listed as the fix, so upgrade soon.
What's affected
The record covers Pandora FMS from 700 through versions below 776. The vendor's security page lists CVE-2023-44092 as an OS command injection fixed in version 776, published 19 March 2024. The page gives no more description and no affected range.
The record scores 7.6 (High), vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. That means high privileges and user interaction are needed, and the scope changes, so the damage can extend beyond Pandora itself. The weakness is CWE-78. The record does not mark the CVE as known exploited.
This CVE was published together with CVE-2023-44091, an SQL injection in the same range. Both are fixed in 776, so one upgrade covers both.
How to check if you're exposed
- Find the Pandora FMS version in the console footer or About page. Versions 700 up to below 776 are in scope.
- On the server, check installed packages, for example
rpm -qa | grep -i pandoraordpkg -l | grep -i pandora. - List the accounts with administrator rights on the console, since the vector requires high privileges.
- Check whether the console is reachable from outside your network.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Upgrade to Pandora FMS 776 or later.
- Cut the number of administrator accounts, remove old ones and enable strong authentication for those that remain.
- Restrict the console to a management network or VPN.
- Run the Pandora services under least privilege accounts on the host.
- Review host logs for unexpected shell processes spawned by the web server or Pandora services.
Why it matters
OS command injection means a program passes user supplied text to the operating system shell without sanitizing it. The attacker can add commands of their own. The record's description says this was used to create a reverse shell, which is an outbound connection that gives an attacker remote control of the host.
The CVSS score is moderate because the attacker needs high privileges. That is little comfort when administrator credentials are shared, weak or phished. A command injection behind a login is still a way to turn one stolen administrator account into control of the server.
Quick check
Is a login required?
The vector says high privileges and user interaction are required, so an administrator account is needed.
Which version fixes it?
Pandora FMS 776, per the vendor's security page.
Sources
Last reviewed: 19 October 2026.
