This vulnerability in LibreNMS allows remote attackers to execute arbitrary OS commands due to insufficient input sanitization in three PHP components: AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory(). It affects versions prior to 24.10.0. The CVSS 3.1 base score of 9.1 reflects the ease of exploitation (network vector, low complexity, no user interaction) and the critical impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-78 (OS Command Injection). No vendor advisory or patch information is currently available.

Successful exploitation can lead to remote code execution, allowing attackers to run arbitrary commands on the affected system. This compromises system confidentiality, integrity, and availability. The vulnerability requires low privileges but no user interaction, making it highly exploitable in network-exposed environments. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected LibreNMS installation to trusted users only and monitor for suspicious activity related to the affected PHP components. Avoid exposing the service directly to untrusted networks.