CVE-2025-65014 - LibreNMS has Weak Password Policy

Back Back to CVE browser

LOW

LibreNMS has Weak Password Policy

Published Nov 18, 2025

3.7

LOW

CVSS 3.1

EPSS 0.25%

Description

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in the user management functionality of the LibreNMS application. This vulnerability allows administrators to create accounts with extremely weak and predictable passwords, such as 12345678. This exposes the platform to brute-force and credential stuffing attacks. This issue has been patched in version 25.11.0.

Affected products

Vendor Librenms Product Librenms Default
n/a
- Version
  < 25.11.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Librenms

n/a

Version	Status	Constraints
< 25.11.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-521

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198060
Advisory
https://github.com/advisories/GHSA-5mrf-j8v6-f45g
Advisory
https://github.com/librenms/librenms/security/advisories/GHSA-5mrf-j8v6-f45g
exploitx_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-65014

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198060		Advisory
https://github.com/advisories/GHSA-5mrf-j8v6-f45g		Advisory
https://github.com/librenms/librenms/security/advisories/GHSA-5mrf-j8v6-f45g		exploitx_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-65014