Description
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| librenms | librenms | < 26.5.0 | 26.5.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | librenms/librenms | < 26.5.0 | 26.5.0 | GHSA-jf24-8g2h-2wg7 |
References
- GitHub Security Advisory (GHSA-jf24-8g2h-2wg7) vendor-advisory
- VulnCheck Advisory: LibreNMS before 26.5.0 Remote Code Execution via AboutController third-party-advisory