CVE-2025-4653

Remote Code Execution leads to Command Injection

Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.

Affected

Pandora FMS · Pandora ITSM

CVSS v4.0 PANDORAFMS

7.0 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:M/U:Green

EPSS

3.35% chance of exploitation in the next 30 days, 89th percentile

Published

2025-06-10

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_itsm_auth_rce…

References

• CVE Record
• NVD entry