Executive brief
LibreNMS, a popular network monitoring system, contains a vulnerability that allows an administrator to execute arbitrary commands on the underlying server. By manipulating the configuration for network diagnostic tools, a malicious user with administrative access can download and run unauthorized scripts. This could lead to a full system takeover, data theft, or further attacks on the internal network.
Technical details
An OS command injection vulnerability exists in LibreNMS due to insufficient validation of binary paths for network diagnostic tools. Authenticated administrators can modify absolute binary paths at '/settings/external/binaries' to point to arbitrary system executables like 'wget' or 'bash'. By bypassing an input filter on the 'GET /ajax/netcmd' endpoint, an attacker can first download a malicious script and subsequently execute it. This allows for full remote code execution (RCE) on the host server. The issue is addressed in version 26.3.0 by restricting binary path configurations.
Affected products
- LibreNMS LibreNMS >= 1.48, < 26.3.0
Timeline
- 2026-03-24: disclosed
- 2026-03-26: advisory
- 2026-03-26: patched: Version 26.3.0 released