DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-JF24-8G2H-2WG7: GHSA-JF24-8G2H-2WG7: Remote Code Execution in LibreNMS AboutController via Binary Path Substitution

#security #cve #cybersecurity #ghsa

GHSA-JF24-8G2H-2WG7: Remote Code Execution in LibreNMS AboutController via Binary Path Substitution

Vulnerability ID: GHSA-JF24-8G2H-2WG7
CVSS Score: 7.2
Published: 2026-08-18

A critical security flaw in LibreNMS allows authenticated administrators to execute arbitrary commands by modifying the configured binary path for snmpget and accessing the About page. This occurs due to insufficient verification of the executable file's identity and integrity prior to executing it with shell_exec.

TL;DR

Authenticated administrators can execute arbitrary system commands by changing the snmpget binary path to a malicious script uploaded on the local filesystem and visiting the /about page.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-77, CWE-78
  • Attack Vector: Network
  • CVSS v3.x Score: 7.2 (High)
  • CVSS v4.0 Score: 6.4 (Medium)
  • Exploit Status: Proof-of-Concept (PoC)
  • KEV Status: Not Listed
  • Affected Component: AboutController.php
  • Patch Version: 26.5.0

Affected Systems

  • LibreNMS Network Monitoring System
  • LibreNMS: < 26.5.0 (Fixed in: 26.5.0)

Code Analysis

Commit: e762c2f

LibreNMS 26.5.0 release patch addressing AboutController Command Injection

Exploit Details

  • GitHub Security Advisory: Official security advisory containing vulnerability analysis and a step-by-step reverse shell proof-of-concept.

Mitigation Strategies

  • Upgrade LibreNMS to version 26.5.0 or later to apply the official vendor patch.
  • Mount writable directories such as /tmp and upload folders with the noexec flag.
  • Implement restrictive network access controls and WAF policies on administrative endpoints.

Remediation Steps:

  1. Log in to the host machine running LibreNMS.
  2. Execute 'git pull' or update via Composer to pull LibreNMS version 26.5.0 or later.
  3. Verify that the configuration for 'snmpget' binary path points to the standard location /usr/bin/snmpget.
  4. Restrict write permissions on /tmp and restrict web panel access to trusted admin IPs.

References

Read the full report for GHSA-JF24-8G2H-2WG7 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)