What’s Vulnerable › Vulnerabilities

CVE-2020-15873

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-07-21 · updated 2026-06-17
• Weakness: CWE-89

Description

In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php.

Affected products

• librenms: before 1.65.1 — fixed in 1.65.1

How to fix

Upgrade to a fixed version: librenms 1.65.1. Check the vendor advisory for mitigations.

References

• https://community.librenms.org/c/announcements
• https://github.com/librenms/librenms/commit/8f3a29cde5bbd8608f9b42923a7d7e2598bcac4e
• https://github.com/librenms/librenms/compare/1.65...1.65.1
• https://github.com/librenms/librenms/pull/11923
• https://research.loginsoft.com/bugs/blind-sql-injection-in-librenms/
• https://community.librenms.org/c/announcements
• https://github.com/librenms/librenms/commit/8f3a29cde5bbd8608f9b42923a7d7e2598bcac4e
• https://github.com/librenms/librenms/compare/1.65...1.65.1
• https://github.com/librenms/librenms/pull/11923
• https://research.loginsoft.com/bugs/blind-sql-injection-in-librenms/

Get alerted when CVE-2020-15873 or the next vulnerability affects your stack