PT-2026-4926 · Librenms · Librenms

Hodorsec · Published 2026-01-27 · Updated 2026-02-02 · CVE-2020-36947

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS version 1.46

Description LibreNMS version 1.46 contains an authenticated SQL injection issue in the MAC accounting graph endpoint. This allows remote attackers to extract database information by manipulating the sort parameter with crafted SQL injection techniques, enabling time-based blind SQL injection. The affected API endpoint is the MAC accounting graph endpoint.

Recommendations Apply a fix or patch for LibreNMS version 1.46 to address the SQL injection issue in the MAC accounting graph endpoint. As a temporary workaround, restrict access to the MAC accounting graph endpoint or sanitize the sort parameter to prevent SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-36947

GHSA-QP2J-V5JG-HG68

Affected Products

Librenms

References · 10

• 🔥 https://exploit-db.com/exploits/49246 · Exploit
• 🔥 https://community.librenms.org · Exploit
• https://osv.dev/vulnerability/GHSA-qp2j-v5jg-hg68 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36947 · Security Note
• https://github.com/librenms/librenms · Note
• https://t.me/cveNotify/150636 · Telegram Post
• https://vulncheck.com/advisories/librenms-mac-accounting-graph-authenticated-sql-injection · Note
• https://librenms.org · Note
• https://t.me/CVEtracker/43071 · Telegram Post