A high-severity OS command injection vulnerability in LibreNMS allows authenticated administrators to achieve remote code execution on the underlying host.

This is an OS command injection flaw (CWE-78) triggered when the libvirt discovery module is enabled. The application fails to sanitize the device hostname before passing it to system shell commands, allowing an authenticated administrator to inject and execute arbitrary OS commands.

Successful exploitation allows an authenticated attacker with administrative privileges to execute arbitrary code with the permissions of the LibreNMS discovery worker process. Given the CVSS score of 8.6, this represents a significant security risk that could lead to full system compromise, lateral movement within the network, and unauthorized access to sensitive monitoring data.

Immediate Action: Update LibreNMS to version 26.4.0 or later to include the necessary input sanitization fixes.

Proactive Monitoring: Review system logs for suspicious process execution patterns originating from the LibreNMS discovery worker or unexpected modifications to device hostnames.

Compensating Controls: If an immediate update is not feasible, consider disabling libvirt support (enable_libvirt=false) within the LibreNMS configuration to neutralize the vulnerable code path.

Public Exploit Available: No (exploit_available unknown).

This vulnerability presents a clear path to remote code execution for any actor with administrative access to the LibreNMS interface. Organizations should prioritize updating to version 26.4.0 immediately to eliminate the vulnerable code path. If patching cannot be performed during the current cycle, disabling the affected libvirt discovery module is a necessary step to maintain the integrity of the monitoring infrastructure.