LibreNMS has Weak Password Policy
Summary
A Weak Password Policy vulnerability was identified in the user management functionality of the LibreNMS application. This vulnerability allows administrators to create accounts with extremely weak and predictable passwords, such as 12345678. This exposes the platform to brute-force and credential stuffing attacks.
Details
Vulnerable Component: User creation / password definition
The application fails to enforce a strong password policy when creating new users. As a result, administrators can define trivial and well-known weak passwords, compromising the authentication security of the system.
PoC
-
Log in to the application using an Administrator account.
-
Navigate to the user management section:
-
Create a new user account using the password
12345678.
- The application accepts the weak password without restrictions and creates the account successfully.
Impact
Weak password policy vulnerabilities can have severe consequences, including:
-
Increased risk of brute-force and credential stuffing attacks
-
Unauthorized access to user or administrative accounts
-
Privilege escalation through compromised credentials
-
Degradation of the overall security posture of the platform
Mitigation
-
Enforce a strong password policy (e.g., minimum of 12 characters with uppercase, lowercase, digits, and special characters).
-
Block the use of commonly known weak passwords (e.g.,
12345678,password,admin,qwerty).
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | librenms/librenms | < 25.11.0 | 25.11.0 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N- Debilidad (CWE)
CWE-521- Plataforma
- Composer
- Paquete
librenms/librenms- Publicada
- 18.11.2025
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-5mrf-j8v6-f45g - CC BY 4.0
Historial de vulnerabilidades: librenms/librenms
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 106
- Primera → última
- 10.2019 08.2026
- Sin corrección
- 6
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 5
- Alta 39
- Media 56
- Baja 6
Divulgaciones por año
- 2019: 6
- 2020: 0
- 2021: 7
- 2022: 26
- 2023: 12
- 2024: 24
- 2025: 15
- 2026: 16
-
LibreNMS has Weak Password Policy esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.