CVE-2024-12992 is a critical (CVSS 9.8) OS command injection in Pandora FMS, affecting versions 700 through 777.6 according to the record. Attackers can achieve remote code execution over the network without logging in. Check the vendor's security page for the fixed release and upgrade.
What's affected
- Pandora FMS from 700 to 777.6, as written in the record.
The record does not name a fixed version. The vendor lists its CVEs on its security page, which is the place to confirm the release to move to.
How to check if you're exposed
Run the check below, or read the vendor or project notes linked in Sources.
# Check the version shown in the console footer or About page,
# then compare it to the vendor's security page.
Compare the result to the affected range above.
What to do now
- Read the vendor's CVE listing at pandorafms.com and confirm the fixed release for your branch.
- Upgrade the Pandora FMS server and console, then confirm every satellite or agent component is on a supported version.
- Make sure the console is not reachable from the internet. Monitoring servers hold credentials for many systems.
- Review the monitoring host for unexpected processes or scheduled tasks.
- Look up CVE-2024-12992 on its Gold page to see the current details and any fix information.
- Check your own dependency files with the free in-browser dependency scan. It runs in your browser and does not send the file to a server.
Why it matters
Command injection happens when input is passed to the operating system shell without being neutralized. The record uses that wording: improper neutralization of special elements used in a command. The vector shows no privileges and no user interaction required, with high impact across the board.
Monitoring platforms are a particularly rewarding target. They sit in the middle of the network, hold credentials and SNMP strings for many hosts, and often have wide reach. A compromise of the monitoring server gives an attacker a map and a set of keys, so it should be patched on the same schedule as an edge device.
This CVE is an OS command injection flaw (CWE-77, Command Injection). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Command injection happens when input reaches the operating system shell without being neutralized. The shell then treats part of the data as instructions. The fix is to avoid the shell, pass arguments as structured values and validate input against an allowlist.
The damage is usually total, because commands run with the service account's rights.
Quick check
Is a fixed version named in the CVE record?
No. Use the vendor's security page to confirm the fix for your branch.
Do I need credentials to exploit it?
The CVSS vector lists no privileges required.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
