Authenticated Remote Code Execution in LibreNMS by Invoking Binary Locations Config
CVE-2026-6204
8.5HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-6204?
An authenticated remote code execution vulnerability exists in LibreNMS versions prior to 26.3.0, which can be exploited by leveraging the Binary Locations configuration and the Netcommand functionality. Attackers with administrative privileges can exploit this flaw to execute arbitrary commands on the underlying web server, potentially compromising the entire system. Proper access controls and prompt updates are crucial to mitigate the risks associated with this vulnerability.
Affected Version(s)
librenms 0 < 26.3.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.