Description
LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| librenms | librenms | 23.10.0 – < 26.4.1 | 26.4.1 |
References
- https://github.com/librenms/librenms/security/advisories/GHSA-7hmq-j399-mqwf vendor-advisory
- https://projectblack.io/blog/librenms-authenticated-rce-26-5-0/#rce-by-command-line-injection-2641 third-party-advisory exploit