An authenticated user of Pandora FMS can exploit a command injection flaw in the net_tools.php module. By supplying an unescaped value to the select_ips parameter during network tool operations such as ping, the input is passed directly to system commands, allowing the attacker to execute arbitrary OS commands on the host. This gives the attacker the same privileges as the authenticated user, potentially leading to full control of the affected server, data theft, or further spread within the network.

Pandora FMS (Artica ST) versions 7.0NG and earlier are impacted. The vulnerability exists in the net_tools.php component that handles ping operations. Administrators should verify the installed version and consider upgrading if it falls within the affected range.

The CVSS score of 8.6 classifies the flaw as high severity, and an EPSS score of 72% indicates a high probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but its high exploitation likelihood and remote nature mean that an attacker with valid credentials can readily attack the system. The attack vector is remote over HTTP/HTTPS and requires authentication—an attacker could log in using compromised credentials or stolen session tokens and then trigger the command injection via the network tools interface.