Stored Cross-Site Scripting Vulnerability in LibreNMS Network Monitoring System
CVE-2025-62411

5.5MEDIUM

Key Information:

Vendor

Librenms

Status
Librenms
Vendor
CVE Published:
16 October 2025

What is CVE-2025-62411?

LibreNMS, a GPL-licensed community network monitoring system, is susceptible to a Stored Cross-Site Scripting vulnerability in its Alert Transports management functionality. When administrators create new Alert Transports, the value entered in the Transport name field is improperly validated and rendered in the Alert Rules page. This oversight allows for arbitrary JavaScript code execution in the browser of the admin user, significantly compromising the system's security. Users are advised to upgrade to version 25.10.0, where this vulnerability has been addressed.

Affected Version(s)

librenms < 25.10.0

References

https://github.com/librenms/librenms/security/advisories/...
x_refsource_CONFIRM
https://github.com/librenms/librenms/commit/706a77085f4d5...
x_refsource_MISC

EPSS Score

11% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.