Vulnerability Description
LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Librenms | Librenms | < 26.3.0 |
Related Weaknesses (CWE)
References
- https://github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fhThird Party Advisory
- https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rceExploitThird Party Advisory
FAQ
What is CVE-2026-6204?
CVE-2026-6204 is a vulnerability with a CVSS score of 7.2 (HIGH). LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires...
How severe is CVE-2026-6204?
CVE-2026-6204 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-6204?
Check the references section above for vendor advisories and patch information. Affected products include: Librenms Librenms.