CVE-2026-84190

LibreNMS versions before 26.5.0 pass the configured path to the snmpget binary into shell_exec() in the AboutController without validation, a command injection flaw (CWE-77). An authenticated administrator can change the snmpget configuration value to point at a malicious executable and then trigger execution simply by loading the /about endpoint. A successful attacker gains remote code execution on the LibreNMS server under the web server account, with high impact on confidentiality, integrity, and availability per the CVSS 4.0 score of 8.7. Any LibreNMS deployment running a version prior to 26.5.0 is affected, though exploitation requires valid administrator credentials to the web UI. No public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at about 0.6%, so no confirmed exploitation is known.

What to do: Upgrade to LibreNMS 26.5.0 or later, which validates the snmpget configuration before it reaches shell_exec(). Until then, restrict administrator access to the web UI (MFA, credential hygiene, VPN/bastion for admin logins), review the current snmpget setting for tampering, and monitor web access logs for requests to /about followed by unexpected process execution as the web server user.