Vulnerability · Published Nov 18, 2025 · Assigned by GitHub_M

CVE-2025-65014LibreNMS has Weak Password Policy

Low 3.7

In plain English

A low-severity security flaw in librenms from librenms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 80.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in the user management functionality of the LibreNMS application. This vulnerability allows administrators to create accounts with extremely weak and predictable passwords, such as 12345678. This exposes the platform to brute-force and credential stuffing attacks. This issue has been patched in version 25.11.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	librenms/librenms	25.11.0	GHSA-5mrf-j8v6-f45g

Affected products (as reported)

Vendor	Product	Versions
librenms	librenms	< 25.11.0

Weakness: CWE-521 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/librenms/librenms/security/advisories/GHSA-5mrf-j8v6-f45g x_refsource_CONFIRM