CVE-2019-10669: LibreNMS collectd graph command injection via weak escaping

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote command injection with public exploit references and a very high EPSS score, tempered by the high privilege level required to reach the vulnerable endpoint.

What it is

LibreNMS through 1.47 passes user-supplied parameters in html/includes/graphs/device/collectd.inc.php through mysqli_real_escape_string, which does not escape shell metacharacters such as the backtick. The unsanitized value reaches the $rrd_cmd variable and is executed through passthru(), allowing OS command injection. The record does not state which later LibreNMS version fixes the flaw.

Impact

An attacker with the required privileges can execute arbitrary operating system commands on the LibreNMS host, compromising confidentiality, integrity and availability of the server and any data it can reach.

Attack surface

The flaw is reachable over the network through the collectd device graph endpoint, but the CVSS vector (PR:H) indicates the attacker must already hold a high-privileged account; no user interaction is required.

Exploitation

CVE-2019-10669 is not listed in CISA KEV, but public exploit write-ups are referenced (Packet Storm and DarkMatter Xen1th Labs) and EPSS is very high at roughly 0.81 (99.6th percentile), indicating elevated real-world exploitation likelihood.

What to do

• Upgrade LibreNMS to a release after 1.47 that fixes the collectd graph command injection; the record does not name the fixed version, so confirm with the vendor.
• If immediate upgrade is not possible, restrict access to the collectd graph endpoint and the LibreNMS web interface to trusted administrative networks.
• Audit and reduce the number of accounts with the high privileges required to reach this endpoint, and enforce strong authentication.
• Review the collectd.inc.php code path to ensure shell arguments are escaped with escapeshellarg() rather than mysqli_real_escape_string().

Detection

• Monitor web server and application logs for requests to html/includes/graphs/device/collectd.inc.php containing shell metacharacters such as backticks, semicolons or pipes.
• Alert on unexpected child processes spawned by the web server or PHP-FPM user, especially rrdtool or shell invocations with unusual arguments.
• Baseline and monitor outbound network connections originating from the LibreNMS host for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.