An improper handling of special elements in the Network Report feature allows an attacker to inject operating system commands, which is a classic OS command injection flaw. This flaw enables the execution of arbitrary shell commands, giving an attacker complete control over the affected server. The weakness is identified as CWE‑78, the standard classification for this type of vulnerability.

Pandora FMS versions from 777 through 800 are vulnerable due to the Network Report module. The issue exists in all deployments of these versions, regardless of platform, unless or until the system is upgraded to v800.1 or v801.

The CVSS score of 8.7 classifies this as a high‑severity vulnerability. EPSS data is not available, and it is not listed in the KEV catalog, so while the exact exploitation probability is not quantified, the flaw allows attackers who can reach the Network Report endpoint to trigger remote code execution, likely through the web interface or API. This provides a serious threat to confidentiality, integrity, and availability for affected systems.