CVE-2018-20434: LibreNMS addhost OS command injection via community parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or interaction required, public exploit code, and a very high EPSS score make this an urgent remote code execution risk.

What it is

LibreNMS 1.46 fails to sanitize the $_POST['community'] parameter in html/pages/addhost.inc.php when creating a new device, and the value is later mishandled by html/includes/output/capture.inc.php. An attacker can inject OS commands that execute when the snmpwalk capture endpoint is requested, giving remote code execution on the monitoring server.

Impact

An attacker gains arbitrary OS command execution as the web server user, allowing full compromise of the LibreNMS host and any credentials or network data it holds.

Attack surface

Reachable over the network through the web interface; the CVSS vector indicates no privileges and no user interaction are required, though the addhost flow is normally an authenticated administrative function.

Exploitation

Not listed in CISA KEV, but EPSS is 0.71487 (99.4th percentile) and multiple references are tagged Exploit with public technical descriptions, indicating working exploit code is available.

What to do

• Upgrade LibreNMS to a release later than 1.46 that fixes the command injection.
• Restrict access to the LibreNMS web interface and addhost/ajax_output endpoints to trusted administrative networks.
• Validate and sanitize the community parameter server-side, rejecting shell metacharacters before it reaches command execution.
• Run the LibreNMS web service under a low-privilege account with no unnecessary shell or network access.

Detection

• Monitor web logs for requests to /ajax_output.php with type=snmpwalk and hostname=localhost or other unexpected values.
• Alert on shell metacharacters (;, |, $(), backticks) in POST bodies to html/pages/addhost.inc.php.
• Watch for child processes spawned by the web server user, especially snmpwalk invocations with unusual arguments.
• Review device-add events and correlate them with subsequent outbound connections or process execution on the LibreNMS host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.