Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-19tx-2gu6-dfb9
Vulnerability ID VCID-19tx-2gu6-dfb9
Aliases CVE-2018-20434
GHSA-62q7-qj6g-gvr7
Summary OS Command Injection LibreNMS allows remote attackers to execute arbitrary OS commands by using the `community` parameter to `html/pages/addhost.inc.php` during creation of a new device, and then making a `/ajax_output.php?id`=capture&format=text&type=snmpwalk&hostname=localhost` request that triggers `html/includes/output/capture.inc.php` command mishandling.
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.66333 https://api.first.org/data/v1/epss?cve=CVE-2018-20434
epss 0.66333 https://api.first.org/data/v1/epss?cve=CVE-2018-20434
epss 0.66333 https://api.first.org/data/v1/epss?cve=CVE-2018-20434
cvssv3.1 9.8 https://drive.google.com/file/d/1LcGmOY8x-TG-wnNr-cM_f854kxk0etva/view?usp=sharing
generic_textual CRITICAL https://drive.google.com/file/d/1LcGmOY8x-TG-wnNr-cM_f854kxk0etva/view?usp=sharing
cvssv3.1 9.8 https://gist.github.com/mhaskar/516df57aafd8c6e3a1d70765075d372d
generic_textual CRITICAL https://gist.github.com/mhaskar/516df57aafd8c6e3a1d70765075d372d
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-62q7-qj6g-gvr7
cvssv3.1 9.8 https://github.com/librenms/librenms
generic_textual CRITICAL https://github.com/librenms/librenms
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2018-20434
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2018-20434
cvssv3.1 9.8 https://shells.systems/librenms-v1-46-remote-code-execution-cve-2018-20434
generic_textual CRITICAL https://shells.systems/librenms-v1-46-remote-code-execution-cve-2018-20434
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2018-20434
https://drive.google.com/file/d/1LcGmOY8x-TG-wnNr-cM_f854kxk0etva/view?usp=sharing
https://github.com/librenms/librenms
https://shells.systems/librenms-v1-46-remote-code-execution-cve-2018-20434
CVE-2018-20434 Exploit https://gist.github.com/mhaskar/516df57aafd8c6e3a1d70765075d372d
CVE-2018-20434 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/46970.rb
CVE-2018-20434 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/47044.py
CVE-2018-20434 https://nvd.nist.gov/vuln/detail/CVE-2018-20434
CVE-2018-20434 Exploit https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/librenms_addhost_cmd_inject.rb
GHSA-62q7-qj6g-gvr7 https://github.com/advisories/GHSA-62q7-qj6g-gvr7
Data source Exploit-DB
Date added June 28, 2019
Description LibreNMS 1.46 - 'addhost' Remote Code Execution
Ransomware campaign use Known
Source publication date June 28, 2019
Exploit type webapps
Platform php
Source update date June 28, 2019
Source URL https://gist.github.com/mhaskar/516df57aafd8c6e3a1d70765075d372d
Data source Metasploit
Description This module exploits a command injection vulnerability in the open source network management software known as LibreNMS. The community parameter used in a POST request to the addhost functionality is unsanitized. This parameter is later used as part of a shell command that gets passed to the popen function in capture.inc.php, which can result in execution of arbitrary code. This module requires authentication to LibreNMS first.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Dec. 16, 2018
Platform Unix
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/http/librenms_addhost_cmd_inject.rb
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://drive.google.com/file/d/1LcGmOY8x-TG-wnNr-cM_f854kxk0etva/view?usp=sharing
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://gist.github.com/mhaskar/516df57aafd8c6e3a1d70765075d372d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/librenms/librenms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-20434
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://shells.systems/librenms-v1-46-remote-code-execution-cve-2018-20434
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.98545
EPSS Score 0.66333
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:39:09.791662+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/librenms/librenms/CVE-2018-20434.yml 38.6.0