CVE-2022-29712 Command injection in librenms
Attackers can execute arbitrary commands on the server via vulnerable parameters in LibreNMS, requiring immediate upgrade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29712?
CVE-2022-29712 is a critical command injection vulnerability in Librenms Librenms, published on 31 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters.
Weakness: CWE-77
Which versions are affected by CVE-2022-29712?
2 open source packages ship an affected version, including librenms/librenms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
librenms/librenms Packagist | All versions | 22.4.0 |
librenms/librenms Packagist | All versions | 22.4.0 |
Products include Librenms Librenms.
How do I fix CVE-2022-29712?
Upgrade librenms/librenms to 22.4.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-29712 being exploited?
There is no known exploitation of CVE-2022-29712 in the wild and no public exploit code.
Other vulnerabilities in Librenms Librenms
- CVE-2023-4982 Cross-site Scripting (XSS) - Stored in librenms/librenms
- CVE-2021-44278 Path traversal in librenms/librenms
- CVE-2019-10665 LibreNMS Information Disclosure
- CVE-2018-20434 LibreNMS arbitrary OS commands execution
- CVE-2026-26988 LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream
Sources
Also known as GHSA-23f2-vgr6-fwv7.