CVE-2019-10669
HighPublic exploitThere is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqli_escape_real_string function.
Published Sep 9, 2019 · Updated Jul 8, 2026
Key Facts
Patch immediately- CVE-2019-10669 is a high-severity vulnerability (CVSS 7.2 v3.1) affecting Librenms.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 81% probability of exploitation in the next 30 days.
- Fixed versions are available, including Librenms <=1.47, Librenms 1.47.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
81%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2019-10669 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqli_escape_real_string function. This function is not the appropriate function to sanitize command arguments as it does not escape a number of command line syntax characters such as (backtick), allowing an attacker to inject commands into the variable $rrd_cmd, which gets executed via passthru().
Affected Products
1 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| LibrenmsLibrenms | See advisory | 1.47 |
Patched Releases
Librenms
<=1.47
Timeline
Publicly disclosed
Sep 9, 2019
Last updated
Jul 8, 2026
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
FAQ
Common Questions.
An issue was discovered in LibreNMS through 1.47.
Affected: Librenms. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Librenms <=1.47, Librenms 1.47.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-10669 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo