LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().
References
| Link | Resource |
|---|---|
| https://github.com/librenms/librenms/security/advisories/GHSA-x645-6pf9-xwxw | Exploit Vendor Advisory |
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/librenms_authenticated_rce_cve_2024_51092.rb | Exploit Third Party Advisory |
| https://github.com/librenms/librenms/security/advisories/GHSA-x645-6pf9-xwxw | Exploit Vendor Advisory |
Configurations
History
12 May 2026, 13:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/librenms/librenms/security/advisories/GHSA-x645-6pf9-xwxw - Exploit, Vendor Advisory | |
| References | () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/librenms_authenticated_rce_cve_2024_51092.rb - Exploit, Third Party Advisory | |
| First Time |
Librenms librenms
Librenms |
|
| CPE | cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:* |
08 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/librenms/librenms/security/advisories/GHSA-x645-6pf9-xwxw - | |
| CWE | CWE-78 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
08 May 2026, 06:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-08 06:16
Updated : 2026-05-12 13:50
NVD link : CVE-2024-51092
Mitre link : CVE-2024-51092
CVE.ORG link : CVE-2024-51092
JSON object : View
Products Affected
librenms
- librenms
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')