LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().

All installations of LibreNMS below version 24.10.0 are affected. The vulnerability is present in the code paths handled by AboutController, SettingsController, and the initRrdDirectory routine within PollDevice. Upgrading to 24.10.0 or later removes the insecure command‑handling code.

The vulnerability is rated high severity, with a CVSS score 9.1, because it allows an attacker to run arbitrary system commands. The lack of authentication requirements is inferred from the description and typical web interface exposure. Its EPSS score of 44% indicates a moderate probability of exploitation, and it is not listed in the CISA KEV catalog. Attackers can reach the affected code paths via standard HTTP requests to the LibreNMS web interface, and if the application runs with elevated privileges, exploitation would lead to full system compromise.