LibreNMS versions prior to 24.10.0 are vulnerable to a classic OS command injection flaw that allows a remote attacker to execute arbitrary system commands. The vulnerability is exposed through the AboutController.php index(), SettingsController.php update(), and PollDevice.php initRrdDirectory() functions, where unvalidated input is passed directly to the operating system. Successful exploitation leads to complete compromise of the host, giving the attacker full control, including the ability to modify or exfiltrate data, install malware, or pivot to other network resources. This flaw presents an immediate risk to confidentiality, integrity, and availability for any LibreNMS instance exposed to untrusted networks or users.

All installations of LibreNMS below version 24.10.0 are affected. The vulnerability is present in the code paths handled by AboutController, SettingsController, and the initRrdDirectory routine within PollDevice. Upgrading to 24.10.0 or later removes the insecure command-handling code.

The vulnerability is rated high severity due to its remote code execution nature and lack of authentication requirements to trigger it. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the affected code paths through standard HTTP requests to the LibreNMS web interface, which is typically exposed to network or external users. If the instance runs with elevated privileges, exploitation would result in system-wide compromise.