CVE-2020-13851: Pandora FMS events feature OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote command execution with public exploit code and a very high EPSS probability, though it requires authenticated low-privilege access and is not in KEV.

What it is

Artica Pandora FMS 7.44 allows remote command execution through the events feature, caused by OS command injection (CWE-78). An authenticated attacker with low privileges can run arbitrary commands on the server, which matters because Pandora FMS is a monitoring platform often holding broad access to managed hosts.

Impact

An attacker gains remote code execution with the privileges of the Pandora FMS server process, allowing full compromise of confidentiality, integrity and availability of that host.

Attack surface

Reachable over the network through the events feature; the CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N). No further detail on the exact endpoint is given in the record.

Exploitation

Public exploit code is referenced (Packet Storm and Core Security advisories tagged Exploit), and EPSS is very high at 0.91 (99.8th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade Pandora FMS to a version later than 7.44 that fixes the events command injection; confirm the fixed release with the vendor.
• If immediate upgrade is not possible, restrict network access to the Pandora FMS web console to trusted management networks.
• Review and minimize accounts with access to the events feature, and remove unused low-privilege accounts.
• Run the Pandora FMS server with least privilege and isolate it from sensitive internal networks.
• Monitor vendor advisories for updated guidance on this and related Pandora FMS issues.

Detection

• Inspect web server and Pandora FMS logs for event submissions containing shell metacharacters or unexpected command strings.
• Alert on child processes spawned by the Pandora FMS web/PHP process, especially shells or system utilities.
• Monitor for outbound connections from the Pandora FMS server to unusual hosts that could indicate command-and-control or exfiltration.
• Audit event creation activity for anomalous users or bursts of event submissions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.