CVEvulnerability

CVE-2026-6204

8.5 HIGH Published 2026-04-13 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-04-13
Last modified
2026-06-17
Assigner
ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a
CVSS 4.0 (ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a)
8.5 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78

Description

LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.

Affected configurations

• librenms librenms (< 26.3.0)

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References