CVE-2025-65014: Librenms/librenms LibreNMS Has Weak Password Policy Vulnerability

LOW
Advisory Identifier: GHSA-5mrf-j8v6-f45g
Share
CVSS 3.7
CWE-521
Published
Advisory Summary

CVE-2025-65014 is a LOW (CVSS 3.7) librenms has weak password policy vulnerability (CWE-521: Weak Password Requirements) affecting Librenms/librenms libraries in the Packagist ecosystem. The issue involves librenms has weak password policy. Remediation is available by upgrading affected packages to version 25.11.0.

CVE-2025-65014 at a Glance

CVE Identifier CVE-2025-65014
GHSA Identifier GHSA-5mrf-j8v6-f45g
Severity LOW
CVSS v3.1 Base Score 3.7
CWE Classification CWE-521: Weak Password Requirements
Affected Product Librenms/librenms
Package Ecosystem Packagist
Published Date
Last Updated

Security Impact

CVSS: 3.7

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2025-65014

To remediate this vulnerability, upgrade all affected Librenms/librenms dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

librenms/librenms fixed: 25.11.0 
Upgrade librenms/librenms to 25.11.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for librenms/librenms

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-65014, inspect your project dependencies for Librenms/librenms:

inspect dependencies for librenms/librenms

Analyze the terminal output to locate any version of Librenms/librenms in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 25.11.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-521: Weak Password Requirements, where the product does not require that users should have strong passwords. In Librenms/librenms, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Summary A **Weak Password Policy** vulnerability was identified in the user management functionality of the _LibreNMS_ application. This vulnerability allows administrators to create accounts with extremely weak and predictable passwords, such as `12345678`. This exposes the platform to brute-force and credential stuffing attacks. --- ## Details **Vulnerable Component:** User creation / password definition The application fails to enforce a strong password policy when creating new users. As a result, administrators can define trivial and well-known weak passwords, compromising the authentication security of the system. --- ## PoC 1. Log in to the application using an **Administrator** account. 2. Navigate to the user management section: 3. Create a new user account using the password `12345678`. <img width="1103" height="852" alt="image" src="https://github.com/user-attachments/assets/a20d4226-9f86-46ee-a4e6-45be91bb6b7b" /> 4. The application accepts the weak password without restrictions and creates the account successfully. <img width="1359" height="487" alt="image" src="https://github.com/user-attachments/assets/9bec15bf-b38f-448b-8f98-acca5724e143" /> --- ## Impact Weak password policy vulnerabilities can have severe consequences, including: - Increased risk of brute-force and credential stuffing attacks - Unauthorized access to user or administrative accounts - Privilege escalation through compromised credentials - Degradation of the overall security posture of the platform --- ## Mitigation - Enforce a strong password policy (e.g., minimum of 12 characters with uppercase, lowercase, digits, and special characters). - Block the use of commonly known weak passwords (e.g., `12345678`, `password`, `admin`, `qwerty`).

CVE-2025-65014 Affected Librenms/librenms Versions

1 component(s)
Fixed Versions:
25.11.0
Product / Package Ecosystem Affected Versions Fixed Version
librenms/librenms
 Packagist
< 25.11.0
25.11.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/librenms/librenms/security/advisories/GHSA-5mrf-j8v6-f45g
NVD — CVE-2025-65014 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65014
Librenms/librenms Source Repository REPOSITORY
https://github.com/librenms/librenms

Frequently Asked Questions

What is CVE-2025-65014?
CVE-2025-65014 is a security vulnerability in Librenms/librenms involving LibreNMS has Weak Password Policy under CWE-521: Weak Password Requirements.
Which Librenms/librenms versions are affected?
Affected versions include releases prior to 25.11.0 across affected packages: librenms/librenms.
What version fixes CVE-2025-65014?
Upgrading to 25.11.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is librenms/librenms affected?
Yes, librenms/librenms is affected in releases prior to 25.11.0. Upgrade your dependency to 25.11.0 or later.
What is the CVSS score of CVE-2025-65014?
CVE-2025-65014 has a CVSS v3.1 base score of 3.7 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
What CWE is associated with CVE-2025-65014?
CVE-2025-65014 is classified under CWE-521: Weak Password Requirements (The product does not require that users should have strong passwords.).
How can I check Packagist dependencies for CVE-2025-65014?
Run the dependency tree command: 'inspect dependencies for librenms/librenms'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5mrf-j8v6-f45g",
  "modified" : "2025-11-19T14:22:58Z",
  "published" : "2025-11-18T18:24:26Z",
  "aliases" : [ "CVE-2025-65014" ],
  "summary" : "LibreNMS has Weak Password Policy",
  "details" : "## Summary\n\nA **Weak Password Policy** vulnerability was identified in the user management functionality of the _LibreNMS_ application. This vulnerability allows administrators to create accounts with extremely weak and predictable passwords, such as `12345678`. This exposes the platform to brute-force and credential stuffing attacks.\n\n---\n\n## Details\n\n**Vulnerable Component:** User creation / password definition\n\nThe application fails to enforce a strong password policy when creating new users. As a result, administrators can define trivial and well-known weak passwords, compromising the authentication security of the system.\n\n---\n\n## PoC\n\n1. Log in to the application using an **Administrator** account.\n    \n2. Navigate to the user management section:  \n      \n3. Create a new user account using the password `12345678`.\n    \n\n<img width=\"1103\" height=\"852\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a20d4226-9f86-46ee-a4e6-45be91bb6b7b\" />\n\n4. The application accepts the weak password without restrictions and creates the account successfully.\n    \n<img width=\"1359\" height=\"487\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9bec15bf-b38f-448b-8f98-acca5724e143\" />\n\n---\n\n## Impact\n\nWeak password policy vulnerabilities can have severe consequences, including:\n\n- Increased risk of brute-force and credential stuffing attacks\n    \n- Unauthorized access to user or administrative accounts\n    \n- Privilege escalation through compromised credentials\n    \n- Degradation of the overall security posture of the platform\n    \n\n---\n\n## Mitigation\n\n- Enforce a strong password policy (e.g., minimum of 12 characters with uppercase, lowercase, digits, and special characters).\n    \n- Block the use of commonly known weak passwords (e.g., `12345678`, `password`, `admin`, `qwerty`).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "librenms/librenms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "25.11.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/librenms/librenms/security/advisories/GHSA-5mrf-j8v6-f45g"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-65014"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/librenms/librenms"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-521" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-11-18T18:24:26Z",
    "nvd_published_at" : "2025-11-18T23:15:56Z"
  }
}