CVE Catalog
CVE-2024-51092
CriticalSummary
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().
Risk Assessment
An attacker could exploit this vulnerability to gain control over the system, potentially leading to serious security implications for the organization.
Recommendation
It is recommended to upgrade LibreNMS to version 24.10.0 or later to mitigate this vulnerability.
Original NVD description (English source)
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().