A critical remote code execution vulnerability in LibreNMS allows authenticated attackers to inject and execute arbitrary OS commands.

The vulnerability is an OS command injection flaw located in AboutController.php, SettingsController.php, and PollDevice.php. It requires low-privileged authentication to trigger the vulnerable functions.

With a CVSS score of 9.1, this vulnerability poses a severe threat, as it permits full system compromise by an authenticated attacker. Exploitation could lead to complete loss of confidentiality, integrity, and availability of the monitoring server and potentially the network segments it manages.

Immediate Action: Update LibreNMS to version 24.10.0 or later immediately to apply the necessary security patches.

Proactive Monitoring: Monitor system logs for shell execution patterns originating from the web service user and audit all device polling configurations.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious payloads targeting these controller scripts.

Public Exploit Available: Yes — a Metasploit module is available.

This vulnerability is highly dangerous due to the availability of automated exploitation tools. All LibreNMS instances must be updated to version 24.10.0 immediately to eliminate this critical RCE vector.