Low severity · published Nov 18, 2025
CVE-2025-65014
LibreNMS has Weak Password Policy
3.7
CVSS
0.3%
EPSS
No
On KEV
Description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in the user management functionality of the LibreNMS application. This vulnerability allows administrators to create accounts with extremely weak and predictable passwords, such as 12345678. This exposes the platform to brute-force and credential stuffing attacks. This issue has been patched in version 25.11.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
librenms · librenms
< 25.11.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65014
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65014
Exploit
https://github.com/librenms/librenms/security/advisories/GHSA-5mrf-j8v6-f45g
More from librenms
9.8
CVE-2026-86426
LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion
9.8
CVE-2022-4070
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0
9.8
CVE-2022-29712
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters
9.8
CVE-2021-44278
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php
9.8
CVE-2019-10665
An issue was discovered in LibreNMS through 1.47