AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2018-20434

CRITICAL · CVSS 9.8 EPSS 71.49% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2019-04-24 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
gist.github.com ↗
External Security References
packetstormsecurity.com ↗ packetstormsecurity.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2018-20434
Severity
CRITICAL
CVSS
9.8
EPSS
71.49%

Original NVD Description

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers html/includes/output/capture.inc.php command mishandling.