CVE-2026-84190 in LibreNMS
Summary
by MITRE • 09/01/2026
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The identified vulnerability represents a critical remote code execution flaw within LibreNMS, specifically affecting versions prior to 26.5.0. This security issue resides in the AboutController component of the application architecture. The core technical deficiency involves improper validation and sanitization of user-supplied input when handling configuration parameters related to SNMP operations. Specifically, the snmpget parameter is directly concatenated into a command string that is subsequently passed to the shell_exec function for execution by the underlying operating system. This design pattern creates a classic command injection vector where an attacker can manipulate the intended behavior of the application by injecting arbitrary commands or pointing the configuration toward malicious executables hosted on the server file system.
The operational impact of this vulnerability is severe due to its potential for full system compromise, albeit with specific access constraints. The exploit requires authentication as an administrator user within the LibreNMS platform. This prerequisite means that while the attack vector is remote and does not require physical access or network-level exploits like buffer overflows, it necessitates a higher level of privilege than typical unauthenticated attacks. Once authenticated, an attacker can modify the snmpget configuration setting to reference a malicious executable file located on the server. By subsequently accessing the /about endpoint, which triggers the execution logic within the AboutController, the application will execute the specified command with the privileges of the web service user account. This typically results in complete control over the host running LibreNMS, allowing for data exfiltration, lateral movement across the network, or establishment of persistent backdoors.
From a classification perspective, this vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The failure to validate and sanitize input before its use in system-level commands is the primary root cause. Furthermore, within the context of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving command and script interpretation, specifically under tactics related to execution and persistence. Attackers leveraging this flaw would likely employ indirect command invocation methods by referencing external files rather than injecting inline payloads directly into the URL or form fields, thereby evading some basic input filtering mechanisms that might look for specific shell metacharacters in direct user inputs.
Mitigation strategies must focus on immediate patching and architectural hardening. The primary remediation is to upgrade LibreNMS to version 26.5.0 or later where this vulnerability has been addressed by the developers through improved input validation and safer execution practices. In environments where upgrading is not immediately feasible, administrators should enforce strict access controls ensuring that only trusted individuals have administrative privileges within the application. Additionally, implementing a Web Application Firewall can provide a layer of defense by detecting and blocking requests containing patterns indicative of command injection or unusual file path references in configuration parameters. It is also advisable to review server-side logging for any signs of unauthorized modifications to SNMP configurations or unexpected executions triggered via the /about endpoint, which could indicate an ongoing exploitation attempt.