CyberRota Analysis
AI-GeneratedLibreNMS versions prior to 26.8.0 are vulnerable to an argument injection flaw in the graph_title parameter, enabling authenticated attackers to inject arbitrary rrdtool commands. This vulnerability allows unauthorized access to RRD files from other devices and can lead to the execution of malicious commands, circumventing device-specific authorization. Organizations using LibreNMS should prioritize patching this vulnerability to protect against potential data breaches and unauthorized command execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized devices, or use newline injection to execute arbitrary rrdtool commands, bypassing per-device authorization checks.