CVE-2010-4279: Artica Pandora Fms

High severity, CVSS 10.0. EPSS: 65.6% chance of exploitation in the next 30 days.

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.

Affected products

• Artica Pandora Fms: up to and including 3.1; version 1.2 only; version 1.3 only; version 1.3.1 only; version 2.0 only; version 2.1 only; …

Published 2010-12-02. Last modified 2026-06-16.