CyberRota Analysis
AI-GeneratedLibreNMS versions prior to 26.5.0 are vulnerable to remote code execution due to improper validation of the snmpget configuration parameter in the AboutController, allowing authenticated administrators to execute arbitrary code. This vulnerability can be exploited by modifying the configuration to reference a malicious executable file, which is triggered when accessing the /about endpoint. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.