RCE in Artica St Pandora Fms

CVE-2014-125124

An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell command, allowing arbitrary command execution as the pandora user. In certain versions (notably 4.1 and 5.0RC1), the pandora user can elevate privileges to root without a password using a chain involving the artica user account. This account is typically installed without a password and is configured to run sudo without authentication. Therefore, full system compromise is possible without any credentials.

Vulnerability class: Command Injection (OS Command Injection)

Published · last modified .

EPSS exploit prediction

EPSS: 0.021 (81.1th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 81.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2014-125124: rose from 0.015 to 0.021.

EPSS over last 30 days · oldest: 0.015 · newest: 0.021 · change: +0.006

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2014-125124?
CVE-2014-125124 is a vulnerability in Artica St Pandora Fms, classified under OS Command Injection. Published 2025-07-31.
Is CVE-2014-125124 known to be exploited?
3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.