Vulnerability record · CVE-2010-4279 · published 2 December 2010
CVE-2010-4279: Pandora FMS default config allows authentication bypass
Artica · Pandora Fms
Pandora FMS 3.1 and earlier ships with an empty loginhash_pwd field in its default configuration, so the console accepts a crafted login request without a valid password. An attacker can authenticate as admin by sending loginhash_user=admin and loginhash_data set to the MD5 hash of "admin", gaining full control of the monitoring console.
Description
The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote admin access with complete impact, public exploit code and very high EPSS probability make this an urgent fix despite the age of the CVE.
What it is
Pandora FMS 3.1 and earlier ships with an empty loginhash_pwd field in its default configuration, so the console accepts a crafted login request without a valid password. An attacker can authenticate as admin by sending loginhash_user=admin and loginhash_data set to the MD5 hash of "admin", gaining full control of the monitoring console.
Impact
An unauthenticated remote attacker obtains administrative access to the Pandora FMS console, which can lead to arbitrary file upload and full compromise of the monitored environment. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.
Attack surface
Reachable over the network via HTTP requests to index.php; no authentication is required and no user interaction is needed. The flaw is in the default configuration rather than a code path requiring special conditions.
Exploitation
Public exploit code exists (Exploit-DB 15639 and 35731, SecurityFocus BID 45112 tagged Exploit) and EPSS gives a 30-day probability of 0.65618 (99.2nd percentile). It is not listed in CISA KEV and no ransomware groups are documented using it.
What to do
- Apply the vendor security patch (pandorafms_console-3.1_security_patch_13Oct2010) or upgrade to a fixed Pandora FMS release.
- Set a non-empty loginhash_pwd value and verify no default or blank credentials remain in the console configuration.
- Restrict network access to the Pandora FMS console so only trusted management hosts can reach index.php.
- Audit console accounts and logs for unexpected admin logins or file uploads, and rotate any credentials that may have been exposed.
Detection
- Search web server logs for POST or GET requests to index.php containing loginhash_user=admin and a loginhash_data value equal to the MD5 hash of "admin".
- Alert on successful admin logins from unexpected source IPs or outside normal administrative hours.
- Monitor for file upload activity or new files in the Pandora FMS console web directory following admin sessions.
- Check Pandora FMS configuration for an empty loginhash_pwd field and flag any instance still running 3.1 or earlier.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-4279 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-4279), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
