CVE-2020-15874: LibreNMS Command Injection RCE Vulnerability

CVE-2020-15874 Overview

CVE-2020-15874 is an authenticated command injection vulnerability in LibreNMS 1.65. The flaw resides in the /graph.php API endpoint. A remote authenticated attacker with normal privileges can execute arbitrary shell commands on the underlying host.

LibreNMS is an open-source network monitoring platform widely deployed to poll SNMP data, generate graphs, and alert on device health. Because the affected endpoint is exposed to any authenticated user, standard operator accounts can escalate access to operating system command execution on the monitoring server.

Critical Impact
An authenticated LibreNMS user can execute arbitrary shell commands on the monitoring host through /graph.php, exposing every device credential and SNMP secret stored by the platform.

Affected Products

LibreNMS 1.65
LibreNMS releases prior to 1.65.1
Deployments installed from source or Docker images pinned to 1.65

Discovery Timeline

2026-08-26 - CVE-2020-15874 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2020-15874

Vulnerability Analysis

The vulnerability is a command injection [CWE-77] reachable through the graph.php endpoint. LibreNMS uses graph.php to render RRD-based charts by translating request parameters into arguments consumed by rrdtool and related shell utilities. Insufficient sanitization allows attacker-controlled input to break out of the intended argument context and inject shell metacharacters.

Authentication is required, but only a normal user role, meaning any operator, read-only user, or compromised low-privilege account can trigger execution. Successful exploitation runs commands under the LibreNMS service account, typically librenms or the web server user, giving direct access to poller scripts, device inventories, and SNMP community strings.

See the Shielder Advisory for LibreNMS for the parameter-level analysis.

Root Cause

The root cause is unsafe construction of shell command strings from HTTP parameters passed to graph.php. The endpoint concatenates user-controlled values into commands executed via PHP process functions without escaping shell metacharacters or restricting the parameter to an expected value set.

Attack Vector

An attacker authenticates to the LibreNMS web interface with any valid account, then issues a crafted request to /graph.php containing shell metacharacters in a vulnerable parameter. The injected payload is passed to the underlying shell and executed on the server. No user interaction beyond the attacker's own session is required.

Code-level details are described in the vendor patch. Refer to the LibreNMS Version Comparison 1.65 diff for the specific input handling changes.

Detection Methods for CVE-2020-15874

Indicators of Compromise

Requests to /graph.php containing shell metacharacters such as backticks, $(, ;, |, or && in query parameters.
Child processes of the web server or PHP-FPM worker spawning shells (sh, bash), curl, wget, nc, or python on the LibreNMS host.
Outbound connections from the LibreNMS server to unfamiliar hosts shortly after authenticated graph.php requests.
New or modified files under the LibreNMS web root, /tmp, or the librenms user home directory.

Detection Strategies

Inspect web server access logs for graph.php requests where parameter values contain URL-encoded shell metacharacters.
Correlate authenticated LibreNMS sessions with process-execution telemetry to flag php or www-data processes launching shell utilities.
Alert on any process descending from the LibreNMS PHP handler that executes reconnaissance commands such as id, uname, or whoami.

Monitoring Recommendations

Forward LibreNMS Apache or Nginx access logs to a centralized log platform and retain full query strings.
Enable process-lineage auditing on the LibreNMS host using auditd or an EDR agent to capture parent-child relationships.
Monitor outbound network traffic from the monitoring server, which should normally speak only SNMP, ICMP, and SMTP.

How to Mitigate CVE-2020-15874

Immediate Actions Required

Upgrade LibreNMS to version 1.65.1 or later using the official LibreNMS Release 1.65.1.
Rotate all device SNMP community strings, API tokens, and stored credentials accessible to the LibreNMS server.
Audit LibreNMS user accounts and disable unused or shared logins that could satisfy the authentication requirement.
Review web server and shell history logs on the LibreNMS host for evidence of prior exploitation.

Patch Information

LibreNMS resolved the issue in release 1.65.1. The fix hardens input handling in the graphing pipeline invoked by graph.php. Deployments should apply the update via ./daily.sh, the Docker image tag 1.65.1 or newer, or a git pull on tracked branches. Details are documented in the LibreNMS Announcements forum.

Workarounds

Restrict access to the LibreNMS web interface to trusted management networks using firewall or reverse-proxy rules.
Enforce multi-factor authentication on all LibreNMS accounts to reduce the risk of credential reuse enabling exploitation.
Run the LibreNMS service under a dedicated unprivileged user with a restricted shell to limit post-exploitation impact.

bash

# Upgrade LibreNMS from 1.65 to 1.65.1
cd /opt/librenms
sudo -u librenms git fetch --tags
sudo -u librenms git checkout 1.65.1
sudo -u librenms ./daily.sh
sudo systemctl restart php-fpm nginx