Yurinek0

**Name of the Vulnerable Software and Affected Versions** LibreNMS (affected versions not specified) **Description** The Virtualization Discovery module contains a command line injection flaw. This allows an authenticated administrator to execute arbitrary code on the host server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions 21.6.0 through 26.4.0 **Description** An authenticated administrator can execute arbitrary operating-system commands on the host server. The issue occurs because the `deliverAlert` function in `LibreNMS/Alert/Transport/Signal.php` insufficiently escapes the `signal-cli` path and the `Recipient` field before passing them to an `exec` call. By pointing the path to the `composer wrapper.php` script, which also contains unsafe `exec` calls, an attacker can chain these calls to achieve remote code execution. **Recommendations** Update to version 26.5.0.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 26.3.0 **Description** An authenticated administrator can execute arbitrary code on the host server by abusing the Binary Locations configuration and the Netcommand feature. The application allows administrative users to configure absolute binary paths for network diagnostic tools at the '/settings/external/binaries' endpoint, but it does not sufficiently validate that these paths remain restricted to safe executables. These tools are invoked via the 'GET /ajax/netcmd' endpoint. Although an input filter exists to restrict arguments to valid IP addresses or hostnames, this filter can be bypassed, allowing an attacker to download and execute malicious payloads, potentially leading to a complete compromise of the underlying web server. **Recommendations** Update to version 26.3.0 or later. As a temporary workaround, restrict access to the '/settings/external/binaries' configuration to minimize the risk of unauthorized binary path modification.