Librenms EUVD-2026-21908

LibreNMS versions before 26.3.0. Attacker requires administrative privileges on LibreNMS. Exploitation abuses Binary Locations config and Netcommand feature to achieve remote code execution on the underlying web server. No user interaction needed.

While the CVSS 8.5 score indicates high severity with significant confidentiality and integrity impact (VC:H/VI:H), the real-world risk is moderated by the high privilege requirement (PR:H) - attackers must already possess administrative credentials to exploit this vulnerability. However, publicly available exploit code significantly lowers the technical barrier for post-compromise lateral movement or privilege escalation from web admin to system-level access. The CVSS vector shows low attack complexity (AC:L) and no user interaction required (UI:N), meaning exploitation is straightforward once admin access is obtained. This vulnerability is most dangerous in scenarios where LibreNMS administrative accounts are compromised through credential theft, phishing, or shared credentials. The attack is not automatable for initial access but becomes highly automatable for attackers who have already compromised admin credentials. From an SSVC perspective: exploitation status is public POC available, technical impact is total system compromise, and automatable is yes (for authenticated attackers). Priority should be high for organizations running LibreNMS, particularly those with multiple administrative users or where admin credential hygiene may be weak. The scope is unchanged (S:N in CVSS 4.0), limiting impact to the LibreNMS server itself rather than enabling pivoting, though compromise of a monitoring system often provides valuable reconnaissance data for broader network attacks.

An attacker who has compromised LibreNMS administrative credentials (through phishing, credential stuffing, or insider threat) logs into the web interface and navigates to the Binary Locations configuration section. The attacker modifies legitimate binary paths to inject shell metacharacters or points entries to attacker-controlled executables uploaded to the web server. When the attacker or automated monitoring tasks trigger the Netcommand feature (used for network diagnostic tools like ping or traceroute), the malicious binary path configuration causes the web server to execute arbitrary commands with the privileges of the LibreNMS application user, typically www-data or similar. Publicly available exploit code from ProjectBlack (https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rce-poc) provides step-by-step exploitation details, making this attack readily reproducible by moderately skilled attackers who have obtained admin access.