CVE-2014-125124

🗓️ 31 Jul 2025 15:00:20Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 37 Views🌐 WEB

Unauthenticated command injection in Pandora FMS allows arbitrary command execution and privilege escalation.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2014-125124	29 May 201815:50	–	circl
CNNVD	Pandora FMS 安全漏洞	31 Jul 202500:00	–	cnnvd
Cvelist	CVE-2014-125124 Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection	31 Jul 202515:00	–	cvelist
EUVD	EUVD-2014-9814	7 Oct 202500:30	–	euvd
Metasploit	Pandora FMS Remote Code Execution	29 Jan 201400:00	–	metasploit
NVD	CVE-2014-125124	31 Jul 202515:15	–	nvd
OpenVAS	Pandora FMS < 5.0 RCE Vulnerability - Active Check	30 Jan 201400:00	–	openvas
OpenVAS	Kloxo SQLi and RCE Vulnerability	22 Feb 201400:00	–	openvas
Positive Technologies	PT-2025-31544 · Undefined · Undefined	31 Jul 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2014-125124: Improper Neutralization of Special Elements used in an OS Command	31 Jul 202500:00	–	rapid7

Vulners

CNA

Node

artica_st pandora_fmsRange0–5.0rc1

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Anyterm service (/anyterm-module)"
    ],
    "product": "Pandora FMS",
    "vendor": "Artica ST",
    "versions": [
      {
        "lessThanOrEqual": "5.0RC1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/pandora_fms_exec.rb
exploit-db	www.exploit-db.com/exploits/31518
vulncheck	www.vulncheck.com/advisories/pandora-fms-anyterm-unauth-command-injection

Parameter	Position	Path	Description	CWE
p	request body	/anyterm-module	Unauthenticated remote command injection via the Anyterm module; the p parameter is unsafely injected into a shell command, allowing arbitrary command execution as the pandora user.	CWE-306, CWE-78

17 Jun 2026 00:04Current

7.3High risk

Vulners AI Score7.3

CVSS 410

EPSS0.02136

SSVC