CVE-2025-23199 Overview
CVE-2025-23199 is a stored cross-site scripting (XSS) vulnerability in LibreNMS, a community-based GPL-licensed network monitoring system. The flaw exists in the descr parameter of the /ajax_form.php endpoint. Authenticated remote attackers can inject malicious JavaScript that persists in the application and executes when other users view or interact with the affected page. The vulnerability affects LibreNMS versions up to and including 24.10.1 and is tracked under [CWE-79]. The maintainers addressed the issue in release 24.11.0.
Critical Impact
Successful exploitation allows an attacker with low-privilege access to execute arbitrary JavaScript in the browser context of other authenticated LibreNMS users, enabling session abuse, unauthorized actions, and exposure of sensitive monitoring data.
Affected Products
- LibreNMS versions up to and including 24.10.1
- LibreNMS installations exposing the /ajax_form.php endpoint
- Deployments where multiple users interact with device or interface description fields
Discovery Timeline
- 2025-01-16 - CVE-2025-23199 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-23199
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw in the LibreNMS web interface. The /ajax_form.php endpoint accepts a descr parameter without sufficient sanitization or output encoding. An authenticated attacker submits a payload containing HTML or JavaScript that is persisted server-side. When another user renders a page that displays the stored descr value, the browser executes the attacker-supplied script in the context of the victim's session.
Because the vulnerability requires user interaction and low-privilege authenticated access, it fits the profile of a targeted stored XSS against operators of a network monitoring platform. Successful exploitation can lead to actions performed on behalf of the victim, exposure of monitoring data visible to that user, and pivot opportunities against infrastructure catalogued in LibreNMS.
Root Cause
The root cause is missing or insufficient input validation and output encoding on the descr field handled by /ajax_form.php. User-supplied content is stored and later rendered in HTML contexts without contextual escaping, allowing script content to be interpreted by the browser rather than displayed as text.
Attack Vector
Exploitation is network-based and requires an authenticated user with permission to submit description content through /ajax_form.php. The attacker submits a crafted description containing an XSS payload. The payload persists in the LibreNMS database. When a higher-privileged operator or another user loads a page rendering that description, the payload executes. No exploit code is publicly available for this issue, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified proof-of-concept code is available. See the vendor advisory for technical details:
[GitHub Security Advisory GHSA-27vf-3g4f-6jp7](https://github.com/librenms/librenms/security/advisories/GHSA-27vf-3g4f-6jp7)
Detection Methods for CVE-2025-23199
Indicators of Compromise
- Description fields in LibreNMS containing HTML tags such as <script>, <img onerror=>, or <svg onload=>
- Unexpected outbound requests from operator browsers to attacker-controlled domains shortly after loading LibreNMS pages
- Anomalous LibreNMS API or configuration changes performed under legitimate operator accounts
Detection Strategies
- Review web server access logs for POST requests to /ajax_form.php containing suspicious descr values with angle brackets or JavaScript keywords
- Audit the LibreNMS database for stored description fields containing script fragments or HTML event handlers
- Correlate operator session activity with unexpected administrative changes to identify session abuse
Monitoring Recommendations
- Enable and centralize LibreNMS application and web server logs in a SIEM for retrospective search
- Alert on repeated modifications to descr fields by low-privilege accounts
- Monitor browser Content Security Policy (CSP) violation reports if a policy is deployed in front of LibreNMS
How to Mitigate CVE-2025-23199
Immediate Actions Required
- Upgrade LibreNMS to version 24.11.0 or later, which contains the official fix
- Audit existing device and port description fields for injected HTML or JavaScript content and sanitize any malicious values
- Rotate LibreNMS user session tokens and review recent administrative actions for signs of abuse
Patch Information
The LibreNMS maintainers addressed CVE-2025-23199 in release 24.11.0. Full details are published in the GitHub Security Advisory GHSA-27vf-3g4f-6jp7. Users are advised to upgrade to the fixed release as no workarounds exist.
Workarounds
- No official workarounds are provided by the vendor; upgrading to 24.11.0 is the only supported remediation
- As a compensating control, restrict LibreNMS access to trusted operators and enforce least-privilege role assignments
- Deploy a strict Content Security Policy in front of LibreNMS to limit inline script execution until patched
# Upgrade LibreNMS via the standard update workflow
cd /opt/librenms
sudo -u librenms ./daily.sh
# Verify version is 24.11.0 or later
php artisan --version
grep -E 'VERSION' includes/common.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.