CVE-2014-125124 is a critical unauthenticated remote command execution vulnerability affecting Pandora FMS versions up to and including 5.0RC1, specifically through its Anyterm web interface. An attacker can inject arbitrary commands into the 'p' parameter of the 'anyterm-module' endpoint, leading to execution as the 'pandora' user. This vulnerability carries a CVSS score of 10.0 (Critical) due to its network-based attack vector, low complexity, and potential for full system compromise without credentials, as the 'pandora' user can often escalate privileges to root. Exploit code is publicly available via Metasploit, and the vulnerability has garnered significant community discussion, indicating high awareness and potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Artica ST | Pandora FMS | >= 0, <= 5.0RC1CNA affecteddefault unaffected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.