CVE-2018-20434

LibreNMS arbitrary OS commands execution

9.8 CriticalPublic exploit

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers html/includes/output/capture.inc.php command mishandling.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

71.5%Up 37.0 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2018-20434
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-78
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-20434
Updated: 2026-11-02

EUVDEUVD-2022-2691 No score

Record: EUVD-2022-2691
Updated: 2026-11-03

GitHub AdvisoriesGHSA-62q7-qj6g-gvr7 9.8

LibreNMS arbitrary OS commands execution

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers html/includes/output/capture.inc.php command mishandling.

Record: GHSA-62q7-qj6g-gvr7
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSV 9.8

Record: CVE-2018-20434
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-62q7-qj6g-gvr7 9.8

LibreNMS arbitrary OS commands execution

Record: GHSA-62q7-qj6g-gvr7
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

Affected products

librenms

Affected packages

Affected packages
Package	Affected	Fixed
`librenms/librenms` Packagist	1.46 to 1.46	None known
`librenms/librenms` Packagist	Listed versions 1.46	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	LibreNMS - addhost Command Injection (Metasploit)	2019-06-05
Exploit-DB	LibreNMS 1.46 - 'addhost' Remote Code Execution	2019-06-28
Metasploit	LibreNMS addhost Command Injection	2018-12-16
PoC in GitHub	mhaskar/CVE-2018-20434	2019-04-25

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-20434 is a critical vulnerability (CVSS 9.8) in Librenms, published April 24, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 71.5%, the 99th percentile. No source names a fixed version.