Executive brief
LAN Management System (LMS), a software suite used by internet service providers to manage local networks and billing, contains a security flaw that allows attackers to take control of the underlying server. By sending a specially crafted IP address parameter, an attacker can execute unauthorized commands on the operating system. This could lead to a total compromise of the management system, exposure of customer data, or disruption of network services.
Technical details
An OS Command Injection vulnerability (CWE-78) exists in LAN Management System (LMS) within the 'getThroughput' function in 'modules/netdevxajax.inc.php'. The root cause is the lack of validation for an IP address parameter before it is passed to the PHP 'exec()' function via a live traffic helper script. An authenticated attacker with access to the web interface can exploit this by injecting shell metacharacters into the IP parameter. This allows for arbitrary code execution with the privileges of the web server user. The vulnerability was addressed in commit 9fcb4de by implementing the 'check_ip()' validation routine.
Affected products
- LMS Developers LAN Management System (LMS) before commit 9fcb4de
Timeline
- 2026-06-18: advisory: Published by CERT.PL and NVD
- 2026-06-18: patched: Fix identified in commit 9fcb4de