CVE-2024-12971 HIGH

CVE-2024-12971: QuickShell Authenticated Command Injection

Vendor Pandora Fms

Product Pandora FMS

Weakness CWE-77

Published March 17, 2025

Last update March 17, 2025

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Green

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6

Key dates

02Disclosure timeline

March 17, 2025 CVE published

March 17, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-12971 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html

Related vulnerabilities

04Related CVE

CVE-2025-65946 Roo Code is Vulnerable to Potential Remote Code Execution via zsh Command Validation Bug CVE-2025-7836 D-Link DIR-816L Environment Variable cgibin lxmldbc_system command injection CVE-2026-4195 D-Link DNS-1550-04 wizard_mgr.cgi command injection CVE-2025-2729 H3C Magic BE18000 HTTP POST Request networkSetup command injection CVE-2024-1781 Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection