EUVD-2026-69027
GHSA-p7jp-qp65-h4xf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via web UI but requires administrator authentication (PR:H); no confidentiality, integrity, or availability headroom is left once arbitrary command execution is achieved.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.
AnalysisAI
Remote code execution in LibreNMS versions before 26.5.0 stems from the AboutController passing the snmpget configuration value directly to shell_exec() with a validation mechanism rendered ineffective by a PHP assignment operator bug. An authenticated administrator can update the snmpget setting to reference any executable already present on the server filesystem, then trigger code execution by visiting the /about endpoint, yielding full host compromise under web server privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active LibreNMS session with administrator-level privileges and the ability to place a valid executable file at a known path on the server filesystem - the configured snmpget value must pass is_file() and is_executable() checks, so the target must be a real, accessible binary. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is substantial but constrained by the administrator privilege requirement, which limits direct exploitation to insiders, compromised admin sessions, or attackers who have escalated via a separate vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade LibreNMS to version 26.5.0 or later, which is the vendor-confirmed fix documented in GHSA advisory GHSA-jf24-8g2h-2wg7 (https://github.com/librenms/librenms/security/advisories/GHSA-jf24-8g2h-2wg7) and the VulnCheck advisory (https://www.vulncheck.com/advisories/librenms-before-26.5.0-remote-code-execution-via-aboutcontroller). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all LibreNMS deployments and determine which are running pre-26.5.0 versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 7.2), this vulnerability is remotely exploit
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. Rate
An issue was discovered in LibreNMS through 1.47. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
An issue was discovered in LibreNMS through 1.47. Rated critical severity (CVSS 9.1), this vulnerability is remotely exp
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database informatio
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated high severity (CVSS 8.8), this vulnera
An issue was discovered in LibreNMS before 1.65.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
An issue was discovered in LibreNMS 1.50.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 8.8), this vulnerability is remotely exploit
Command injection in LibreNMS's Virtualization Discovery module enables authenticated administrator-level users to execu
Remote code execution in LibreNMS network monitoring platform (versions prior to 26.3.0) allows authenticated administra
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today