Artica · Artica Pandora Fms · CVE-2020-8947
**Name of the Vulnerable Software and Affected Versions**
Artica Pandora FMS version 7.0
**Description**
The issue allows remote attackers to execute arbitrary OS commands via shell metacharacters in the "index.php?operation/netflow/nf live view" API endpoint, specifically in the `ip dst`, `dst port`, or `src port` parameters.
**Recommendations**
For Artica Pandora FMS version 7.0, consider restricting access to the "index.php?operation/netflow/nf live view" API endpoint to minimize the risk of exploitation, and avoid using the `ip dst`, `dst port`, or `src port` parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.