PT-2026-84157 · Librenms · Librenms
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
LibreNMS versions 23.10.0 through 26.3.x
Description
An authenticated administrator can execute arbitrary operating system commands in the discovery worker context. The issue occurs when libvirt support is enabled via the
enable libvirt=true configuration. The software fails to properly sanitize the device hostname hostname before concatenating it into shell commands such as ssh, virsh list, virsh dumpxml, and virsh domstate within the VminfoLibvirt.php file. These commands are then passed to the exec() function without using escapeshellarg() or proper argument separation, allowing a crafted hostname to inject malicious commands.Recommendations
Update LibreNMS to version 26.4.0 or newer.
As a temporary mitigation, disable libvirt discovery by setting
enable libvirt=false if the feature is not required.Exploit
Fix
RCE
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Librenms