CVE-2025-23198: LibreNMS Network Monitor XSS Vulnerability

CVE-2025-23198 Overview

CVE-2025-23198 is a stored cross-site scripting (XSS) vulnerability in LibreNMS, a community-based GPL-licensed network monitoring system. The flaw affects the device edit interface at /device/$DEVICE_ID/edit through the display parameter. Attackers with authenticated access can inject malicious JavaScript that executes when other users view or interact with the affected page. LibreNMS versions up to and including 24.10.1 are affected. The issue was addressed in release 24.11.0.

Critical Impact
Authenticated attackers can inject persistent JavaScript into device configuration data, leading to session hijacking, unauthorized actions performed in the context of other users, and exposure of sensitive monitoring data.

Affected Products

LibreNMS versions up to and including 24.10.1
LibreNMS network monitoring web interface
Deployments exposing the /device/$DEVICE_ID/edit endpoint

Discovery Timeline

2025-01-16 - CVE-2025-23198 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23198

Vulnerability Analysis

The vulnerability is a stored XSS issue classified under CWE-79, Improper Neutralization of Input During Web Page Generation. The display parameter submitted through the device edit form at /device/$DEVICE_ID/edit is persisted to the database without adequate output encoding. When any authenticated user later loads a page that renders the stored display value, the injected script executes in the victim's browser session.

Because LibreNMS is used by network operations teams, victims typically hold elevated privileges. An attacker can leverage the payload to perform administrative actions, exfiltrate device credentials, or pivot into the broader monitored infrastructure. Exploitation requires low-privilege authentication and user interaction, and the scope change means the injected script runs in a security context different from the vulnerable component.

Root Cause

The root cause is missing sanitization and output encoding on the display field within the device edit workflow. User-controlled input is stored verbatim and rendered into HTML contexts without HTML entity encoding or context-aware escaping.

Attack Vector

Exploitation proceeds over the network against an authenticated LibreNMS session. An attacker with permissions to edit device metadata submits a crafted display value containing JavaScript. The payload is stored in the LibreNMS database and served on subsequent renderings of the device view. When another user, typically an administrator, loads the page, the script executes with that user's privileges. See the LibreNMS security advisory GHSA-pm8j-3v64-92cq for advisory details.

Detection Methods for CVE-2025-23198

Indicators of Compromise

Device records with display field values containing HTML tags such as <script>, <img onerror=>, or <svg onload=>.
Unexpected outbound requests from administrator browsers to attacker-controlled domains following visits to /device/*/edit or device view pages.
Audit log entries showing device edits by low-privilege accounts that modify only the display parameter.

Detection Strategies

Query the LibreNMS database for devices rows where the display column contains HTML metacharacters or JavaScript keywords.
Inspect web server access logs for POST requests to /device/*/edit with payloads containing encoded script content.
Correlate device edits with subsequent anomalous session activity from users who viewed the modified device.

Monitoring Recommendations

Enable and centralize LibreNMS application and web server logs for review of device modification events.
Alert on Content Security Policy (CSP) violation reports generated by the LibreNMS front end.
Track privileged account activity for unusual API calls or configuration changes shortly after loading device pages.

How to Mitigate CVE-2025-23198

Immediate Actions Required

Upgrade LibreNMS to version 24.11.0 or later, which contains the vendor fix.
Audit existing device records for stored payloads in the display field and sanitize or remove suspicious entries.
Rotate credentials and session tokens for any administrator whose browser may have executed injected content.

Patch Information

The vendor addressed CVE-2025-23198 in LibreNMS release 24.11.0. Refer to the LibreNMS GitHub Security Advisory GHSA-pm8j-3v64-92cq for the official remediation guidance. There are no vendor-provided workarounds for this vulnerability.

Workarounds

No official workarounds are available; upgrading is the only supported remediation.
As a defense-in-depth measure, restrict device edit permissions to a minimal set of trusted operators until the upgrade is completed.
Deploy a strict Content Security Policy in front of the LibreNMS UI to limit the impact of injected scripts.

bash

# Upgrade LibreNMS using the standard update procedure
cd /opt/librenms
sudo -u librenms ./daily.sh
# Verify the installed version is 24.11.0 or later
sudo -u librenms php artisan --version
grep VERSION includes/common.php