Authenticated attackers can execute arbitrary OS commands via a command injection vulnerability in the LibreNMS Virtualization Discovery module.

The module fails to properly neutralize special characters in user-supplied input before passing it to system commands, leading to command injection. This vulnerability requires high-level administrative privileges.

Successful exploitation allows an authenticated user to gain full control over the host server, leading to complete system compromise. The CVSS score of 8.6 reflects the severe risk of arbitrary code execution, which could result in lateral movement and total data exfiltration.

Immediate Action: Update LibreNMS to version 26.4.1 or later to remediate the command injection flaw.

Proactive Monitoring: Review system logs for unusual process execution or shell commands originating from the web service user.

Compensating Controls: Restrict access to the administrative interface to trusted networks and ensure the web service is running with the least privilege necessary to mitigate potential damage from a successful injection.

Public Exploit Available: Yes, reference is available via Project Black blog.

While this vulnerability requires administrative privileges, the potential for full system compromise necessitates immediate action. Organizations should patch to version 26.4.1 as soon as possible and audit administrative accounts for unauthorized activity.