Which versions of LMS are affected by CVE-2026-40456?

A high-severity command injection vulnerability in LMS (LAN Management System) allows authenticated adjacent network users to execute arbitrary operating system commands, potentially compromising…. A patch is available.

How to fix or mitigate CVE-2026-40456?

Within 24 hours: Inventory all LMS deployments and identify which versions are affected (prior to commit 9fcb4de). Within 7 days: Apply available upstream patch from vendor advisory and upgrade all instances to patched versions. Within 30 days: Verify patch deployment across all systems and audit network access controls to LMS interfaces.

LMS CVE-2026-40456

Q: What is the CVSS score of CVE-2026-40456?

CVE-2026-40456 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-37875 HIGH

OS Command Injection (CWE-78)

2026-06-18 CERT-PL

GHSA-765c-7qf8-cw9w

Command Injection Lms

8.6

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

8.6 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Adjacent management network access plus an authenticated low-privileged LMS operator account are required; once reached, exec() injection yields full host compromise with no user interaction.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 18, 2026 - 12:31 vuln.today

Analysis Generated

Jun 18, 2026 - 12:31 vuln.today

DescriptionCVE.org

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to execute arbitrary operating system commands.

AnalysisAI

OS command injection in LMS (LAN Management System) before commit 9fcb4de allows authenticated adjacent attackers to execute arbitrary operating system commands by supplying a malicious IP address parameter that is passed unsanitized to exec(). The flaw was reported by CERT-PL and an upstream fix is available; no public exploit identified at time of analysis, and the CVSS 4.0 score of 8.6 reflects high impact on the vulnerable system with limited subsequent-system effect.

Technical ContextAI

LMS (chilek/lms) is an open-source PHP-based ISP/LAN management system used by network operators for subscriber, node, and network-device administration. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command) in the AJAX handlers modules/netdevxajax.inc.php (getFirstFreeAddress) and modules/nodexajax.inc.php (updateNodeLock), where a user-controlled $ip parameter was interpolated into a shell command string passed to PHP's exec() with no validation. The patch adds a check_ip($ip) guard alongside the existing empty($cmd) check, rejecting any value that is not a syntactically valid IP address before invoking the shell. The affected CPE is cpe:2.3:a:lms:lms:*:*:*:*:*:*:*:* covering all versions prior to commit 9fcb4de19b7d76394898dbc124252b86b07ac0ed.

RemediationAI

Upstream fix available (commit 9fcb4de); released patched version not independently confirmed - apply the upstream patch https://github.com/chilek/lms/commit/9fcb4de19b7d76394898dbc124252b86b07ac0ed or upgrade to any LMS build that includes it, which adds check_ip($ip) validation to getFirstFreeAddress() and updateNodeLock(). If patching is not immediately possible, restrict access to the LMS web interface to a trusted management VLAN (consistent with the AV:A vector), tightly review which operator accounts hold the privileges needed to call the netdev and node AJAX endpoints, and consider temporarily disabling network-device management features that invoke ping/exec helpers - the trade-off is loss of automated IP-availability checks and node-lock workflows. Monitor LMS audit logs and the web server's process tree for unexpected shell invocations originating from PHP. Cross-reference the CERT-PL advisory at https://cert.pl/posts/2026/06/CVE-2026-40455 for further guidance.