CVE-2018-20434

CRITICAL

LibreNMS 1.46 - OS Command Injection via $_POST['community'] Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2018-20434. PoCs published by Askar, Metasploit, mhaskar, including Metasploit module exploits/linux/http/librenms_addhost_cmd_inject.

AI-analyzed exploit summary This exploit leverages an authenticated RCE vulnerability in LibreNMS v1.46 by injecting a reverse shell payload into the SNMP community field during device creation. The payload is executed when the application processes the SNMP walk request.

Description

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers html/includes/output/capture.inc.php command mishandling.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Askar · pythonwebappsphp
https://www.exploit-db.com/exploits/47044

This exploit leverages an authenticated RCE vulnerability in LibreNMS v1.46 by injecting a reverse shell payload into the SNMP community field during device creation. The payload is executed when the application processes the SNMP walk request.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: LibreNMS v1.46
Auth required
Prerequisites: Valid authentication cookies for LibreNMS · Network connectivity to the target · Netcat listener on attacker's machine
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/46970

This Metasploit module exploits a command injection vulnerability in LibreNMS by injecting arbitrary commands via the unsanitized 'community' parameter in the addhost functionality. It authenticates, adds a device with a malicious payload, triggers the payload, and cleans up by deleting the device.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: LibreNMS v1.46
Auth required
Prerequisites: Valid LibreNMS credentials · Network access to the LibreNMS web interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 9 stars
by mhaskar · poc
https://github.com/mhaskar/CVE-2018-20434

This exploit leverages an authenticated RCE vulnerability in LibreNMS v1.46 by injecting a reverse shell payload into the SNMP community field during device creation. The payload is executed when the application processes the device via an AJAX request.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: LibreNMS v1.46
Auth required
Prerequisites: Valid authenticated session cookies · Network connectivity to target · Listener setup for reverse shell
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by mhaskar, Shelby Pace · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/librenms_addhost_cmd_inject.rb

This Metasploit module exploits a command injection vulnerability in LibreNMS by injecting arbitrary commands via the 'community' parameter in the addhost functionality. It authenticates, adds a device with a malicious payload, triggers the payload execution, and cleans up by deleting the device.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: LibreNMS (versions prior to fix for CVE-2018-20434)
Auth required
Prerequisites: Valid LibreNMS credentials · Network access to the LibreNMS web interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit, Third Party Advisory x_refsource_misc
https://gist.github.com/mhaskar/516df57aafd8c6e3a1d70765075d372d
Permissions Required, Third Party Advisory x_refsource_misc
https://drive.google.com/file/d/1LcGmOY8x-TG-wnNr-cM_f854kxk0etva/view?usp=sharing
Exploit, Technical Description, Third Party Advisory x_refsource_misc
https://shells.systems/librenms-v1-46-remote-code-execution-cve-2018-20434/

Scores

CVSS v3 9.8
EPSS 0.6633
EPSS Percentile 98.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
librenms/librenms 1.46
librenms/librenms Packagist
Published Apr 24, 2019
Tracked Since Feb 18, 2026