CyberRota Analysis
AI-GeneratedLibreNMS versions from 23.10.0 to 26.2.0 are vulnerable to an authenticated OS command injection due to improper handling of device hostnames in libvirt discovery. This flaw allows authenticated administrators to inject arbitrary OS commands, potentially leading to remote code execution within the discovery worker context. Organizations using affected versions with libvirt support enabled should prioritize patching to version 26.4.0 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enabled (enable_libvirt=true), the device hostname ($this->getDevice()->hostname) is concatenated into shell commands (ssh, virsh list/dumpxml/domstate) in VminfoLibvirt.php and passed to exec() without escapeshellarg() or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands, leading to remote code execution in the discovery worker context.