What’s Vulnerable › Vulnerabilities

CVE-2025-65014: LibreNMS has Weak Password Policy

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-18 · updated 2026-10-19
• Weakness: CWE-521

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in the user management functionality of the LibreNMS application. This vulnerability allows administrators to create accounts with extremely weak and predictable passwords, such as 12345678. This exposes the platform to brute-force and credential stuffing attacks. This issue has been patched in version 25.11.0.

Affected products

• librenms: before 25.11.0 — fixed in 25.11.0

How to fix

Upgrade to a fixed version: librenms 25.11.0. Check the vendor advisory for mitigations.

References

• https://github.com/librenms/librenms/security/advisories/GHSA-5mrf-j8v6-f45g
• https://github.com/librenms/librenms/security/advisories/GHSA-5mrf-j8v6-f45g

Get alerted when CVE-2025-65014 or the next vulnerability affects your stack