CVE-2024-51092
Critical · 9.1CVSS
9.1
EPSS
7.2%
Published
May 8, 2026
CISA due date
—
The record
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | librenms/librenms | 0 | 24.10.0 |
Related vulnerabilities
- CVE-2026-26992 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26991 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-27016 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26989 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26990 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26988 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26987 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- GHSA-79q9-wc6p-cf92 LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php Also affects librenms/librenms