CVE-2024-51092: LibreNMS has an Authenticated OS Command Injection

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 7.2%, percentile 94: FIRST’s model estimates a 7.2% chance of exploitation activity in the next 30 days, higher than 94% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Only applies if your dependency tree includes librenms/librenms (Composer (PHP)) <= 24.9.1, fixed in 24.10.0. Check your lockfile, including transitive dependencies.

What it is

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().

From the GitHub advisory

Summary An authenticated attacker can create dangerous directory names on the system and alter sensitive configuration parameters through the web portal. Those two defects combined then allows to inject arbitrary OS commands inside shellexec() calls, thus achieving arbitrary code execution.

Details OS Command Injection We start by inspecting the file app/Http/Controllers/AboutController.php, more particularly the index() method which is executed upon simply visiting the /about page:

We can see that the versionnetsnmp key receives a value direclty dependent of a shellexec() call. The argument to this call reflects a configuration parameter with no sanitization. Should an attacker identify a way to alter this parameter, the server is at risk of being compromised.

Configuration parameters poisoning We now focus on the update() method of the SettingsController.php script. This method is called when the user visits the route /settings/{key} via HTTP PUT. The key parameter here is simply the name of the configuration key the user wishes to modify.

We can see that some protections are implemented around the configuration parameters by $configitem->checkValue($value), with a format of data being expected depending on the data type of the variable the user wants to modify. Specifically, the snmpget configuration variable expects a valid path to an existing binary on the system. To summarize : if an attacker finds a valid full-path to a system binary, while that full-path also holds shell metacharacters, then those characters would be interpreted by the shellexec() call defined above and allow for arbitrary command execution.

Weakness type: CWE-78.

Product: librenms/librenms (Composer (PHP)) · Assigned by: mitre · Published: 2026-05-08

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: low (any account)
• User interaction: none
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable no, technical impact partial.
• FIRST EPSS (model of 2026-10-21): 7.18% probability of exploitation activity in the next 30 days; percentile 94.

Timeline

• 2024-11-15 — GitHub-reviewed advisory GHSA-x645-6pf9-xwxw published (critical)
• 2026-05-08 — CVE record last updated
• 2026-05-08 — CVE record published by mitre

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-x645-6pf9-xwxw github.com
2. CVE.org record CVE-2024-51092 cve.org
3. NVD entry CVE-2024-51092 nvd.nist.gov

Other references from the CVE record and advisory

1. raw.githubusercontent.com raw.githubusercontent.com
2. github.com github.com

Critical Composer (PHP) advisories · Today’s Security Digest