CVE-2024-12971

QuickShell Authenticated Command Injection

CVSS 8.6 HIGHEPSS 59.4%CWE-77

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 8.6EPSS 59.4%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

17 Mar 2025Metasploit module available

17 Mar 2025Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Green

Affected products

Pandora FMS · Pandora FMS

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/