CVE-2026-6204 PUBLISHED

Assigner: PRJBLK
Reserved: 13.04.2026 Published: 13.04.2026 Updated: 13.04.2026

LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.5

Product Status

Vendor librenms
Product librenms
Versions Default: unaffected
  • affected from 0 to 26.3.0 (excl.)

References

Problem Types

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') CWE

Impacts

  • CAPEC-88 OS Command Injection