This vulnerability permits an attacker to inject arbitrary operating system commands through the Event Response execution mechanism in Pandora FMS. The injected commands are executed with the privileges of the Pandora FMS service, potentially leading to full compromise of the host. Being an OS Command Injection flaw (CWE‑78), the impact is high, reflected in a CVSS score of 7.5.

Pandora FMS versions 777 through 800 are impacted. The problem has been corrected in the publicly released v800.1 and v801 updates. Any deployment running a vulnerable revision must upgrade to a patched version to eliminate the risk.

The CVSS base score of 7.5 indicates substantial risk, yet there is no EPSS data and the vulnerability is not listed in CISA's KEV catalog, suggesting no active exploitation. The likely attack vector is inferred to be remote exploitation via the Pandora FMS web interface or API that triggers Event Response execution, requiring the attacker to supply unsanitized input. Successful exploitation would allow arbitrary command execution on the host that runs the service.