CVE-2024-11320 MEDIUM

CVE-2024-11320: Command Injection leading to RCE via LDAP Misconfiguration

Vendor Pandora Fms

Product Pandora FMS

Weakness CWE-77

Published November 21, 2024

Last update November 21, 2024

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/S:P/AU:N/R:U/V:C/RE:M/U:Amber

What the vulnerability does

01Description

Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4

Key dates

02Disclosure timeline

November 21, 2024 CVE published

November 21, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-11320 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html

Related vulnerabilities

04Related CVE

CVE-2026-10180 TRENDnet TEW-432BRP formSysCmd command injection CVE-2026-13538 Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection CVE-2026-9440 Edimax BR-6478AC POST Request formAccept command injection CVE-2026-46529 PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen CVE-2026-48116 AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill