CVE-2024-51092

Deeper analysis

LibreNMS versions prior to 24.10.0 contain an OS command injection vulnerability tracked as CVE-2024-51092 and assigned CWE-78. The flaw resides in the index() method of AboutController.php, the update() method of SettingsController.php, and the initRrdDirectory() method of PollDevice.php, enabling remote code execution when attacker-controlled input reaches operating-system command execution paths.

An authenticated remote attacker with low privileges can supply crafted input to these controllers and achieve arbitrary code execution on the underlying host. The CVSS 9.1 score reflects network attack vector, low complexity, and changed scope, allowing confidentiality, integrity, and availability impacts that extend beyond the vulnerable application.

Public references include the GitHub Security Advisory GHSA-x645-6pf9-xwxw, which documents the affected components and the availability of a fix in version 24.10.0, along with a Metasploit module that implements the exploit.

The EPSS score rose sharply from low values to a peak of 0.7331 on 2026-05-09, the day after disclosure, before receding to the current 0.4411; this trajectory indicates that exploitation interest materialized quickly after the advisory was published.