PT-2025-42519 · Librenms · Librenms

Published 2025-10-16 · Updated 2025-10-17 · CVE-2025-62411

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 25.10.0

Description LibreNMS, a network monitoring system, contains a Stored Cross-Site Scripting (XSS) issue in the Alert Transports management functionality. The Transport name field is stored without proper validation and rendered in the Transports column of the Alert Rules page, leading to arbitrary JavaScript execution in an administrator’s browser. The injection point is the Transport name field in the '/alert-transports' API endpoint, and the execution point is the Transports column in the '/alert-rules' API endpoint. The vulnerability affects only administrator accounts.

Recommendations Update LibreNMS to version 25.10.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62411

GHSA-FRC6-PWGR-C28W

Affected Products

Librenms

References · 12

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-frc6-pwgr-c28w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62411.json · Exploit
• https://github.com/librenms/librenms/commit/706a77085f4d5964f7de9444208ef707e1f79450 · Patch
• https://osv.dev/vulnerability/CVE-2025-62411 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-frc6-pwgr-c28w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62411 · Security Note
• https://github.com/librenms/librenms · Note
• https://github.com/librenms/librenms/commit/e1ead366239b57e88f9a06d4f7c213b1e2530cd8 · Note
• https://github.com/librenms/librenms/releases/tag/25.10.0 · Note
• https://twitter.com/VulmonFeeds/status/1978995069177692507 · Twitter Post
• https://twitter.com/CVEnew/status/1978926569335706057 · Twitter Post
• https://t.me/CVEtracker/35133 · Telegram Post