CVE-2025-23201: LibreNMS XSS Vulnerability

CVE-2025-23201 Overview

CVE-2025-23201 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in LibreNMS, a community-based GPL-licensed network monitoring system. The flaw resides in the community parameter of the /addhost endpoint. Attackers can inject malicious JavaScript that executes when a user views or interacts with the affected page. Successful exploitation can lead to unauthorized actions performed in the victim's session or exposure of sensitive monitoring data. All LibreNMS versions up to and including 24.10.1 are affected. Maintainers addressed the issue in release 24.11.0.

Critical Impact
Authenticated attackers can inject script payloads through the /addhost community parameter, enabling session hijacking, credential theft, and unauthorized actions against LibreNMS operators.

Affected Products

LibreNMS versions up to and including 24.10.1
Fixed in LibreNMS 24.11.0
All deployments exposing the /addhost interface to authenticated users

Discovery Timeline

2025-01-16 - CVE-2025-23201 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23201

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in the LibreNMS host addition workflow. The application accepts the community parameter from the /addhost endpoint without adequately sanitizing or encoding its content before rendering it back to users. When another operator views the resulting page, the browser executes the injected script in the LibreNMS origin.

Exploitation requires user interaction, meaning a victim must load or interact with a page displaying the malicious value. The attack executes with the privileges of the viewing user, which typically includes network monitoring administrators. Consequences include session token theft, forced API calls, modification of monitored devices, and pivoting into internal network infrastructure managed through LibreNMS.

Root Cause

The root cause is insufficient output encoding of user-supplied input in the community field. SNMP community strings are treated as trusted display data rather than untrusted input. The application fails to apply context-appropriate HTML encoding when rendering the value in the LibreNMS interface, allowing <script> tags and event handlers to execute.

Attack Vector

An attacker with the ability to submit host records supplies a crafted community value containing JavaScript. The payload is stored and later served to any user visiting the affected view. Because the payload executes in the LibreNMS session context, the attacker can perform any action the victim is authorized to perform.

No verified public proof-of-concept code is available. Refer to the LibreNMS GitHub Security Advisory (GHSA-g84x-g96g-rcjc) for maintainer-provided details.

Detection Methods for CVE-2025-23201

Indicators of Compromise

HTTP POST requests to /addhost containing <script>, onerror=, onload=, or javascript: sequences in the community parameter
Unexpected outbound requests from operator browsers to attacker-controlled domains shortly after visiting LibreNMS pages
New or modified host entries with anomalous community string values containing HTML or URL-encoded payloads
Session activity from LibreNMS operator accounts originating from unfamiliar IP addresses

Detection Strategies

Inspect web server and application logs for /addhost requests whose community parameter contains angle brackets, quotes, or script keywords
Review LibreNMS database rows in host tables for community values that are not valid SNMP strings
Deploy a web application firewall rule that flags XSS payload patterns targeting LibreNMS endpoints
Correlate operator browser telemetry with LibreNMS access to identify script execution from monitoring pages

Monitoring Recommendations

Enable verbose access logging on the LibreNMS front-end web server and forward logs to a central analytics platform
Monitor for unexpected changes to LibreNMS user roles, API tokens, or host inventory following operator sessions
Alert on Content Security Policy (CSP) violation reports from the LibreNMS origin
Track the LibreNMS version in inventory systems to identify hosts still running vulnerable releases at or below 24.10.1

How to Mitigate CVE-2025-23201

Immediate Actions Required

Upgrade LibreNMS to version 24.11.0 or later, which contains the vendor fix
Audit existing host records for community strings containing HTML or script content and remove malicious entries
Rotate LibreNMS operator sessions and API tokens if suspicious /addhost submissions are found in logs
Restrict access to the LibreNMS web interface to trusted management networks using firewall or reverse proxy rules

Patch Information

The LibreNMS maintainers addressed CVE-2025-23201 in release 24.11.0. Upgrade instructions and advisory details are available in the LibreNMS GitHub Security Advisory (GHSA-g84x-g96g-rcjc). No official workarounds exist, so upgrading is the required remediation.

Workarounds

No vendor-approved workarounds exist for CVE-2025-23201; upgrading to 24.11.0 is required
As a temporary compensating control, limit /addhost access to a small number of trusted administrators
Enforce a strict Content Security Policy on the LibreNMS origin to reduce the impact of injected scripts
Require operators to use isolated browser profiles when accessing LibreNMS to limit cross-site data exposure

bash

# Verify installed LibreNMS version and upgrade
cd /opt/librenms
./daily.sh
git fetch --tags
git checkout 24.11.0
./scripts/composer_wrapper.php install --no-dev
php artisan migrate