{"id":"CVE-2025-65014","aliases":["GHSA-5mrf-j8v6-f45g"],"url":"https://o3.security/vulnerability/CVE-2025-65014","summary":"LibreNMS has Weak Password Policy","details":"## Summary\n\nA **Weak Password Policy** vulnerability was identified in the user management functionality of the _LibreNMS_ application. This vulnerability allows administrators to create accounts with extremely weak and predictable passwords, such as `12345678`. This exposes the platform to brute-force and credential stuffing attacks.\n\n---\n\n## Details\n\n**Vulnerable Component:** User creation / password definition\n\nThe application fails to enforce a strong password policy when creating new users. As a result, administrators can define trivial and well-known weak passwords, compromising the authentication security of the system.\n\n---\n\n## PoC\n\n1. Log in to the application using an **Administrator** account.\n    \n2. Navigate to the user management section:  \n      \n3. Create a new user account using the password `12345678`.\n    \n\n<img width=\"1103\" height=\"852\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a20d4226-9f86-46ee-a4e6-45be91bb6b7b\" />\n\n4. The application accepts the weak password without restrictions and creates the account successfully.\n    \n<img width=\"1359\" height=\"487\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9bec15bf-b38f-448b-8f98-acca5724e143\" />\n\n---\n\n## Impact\n\nWeak password policy vulnerabilities can have severe consequences, including:\n\n- Increased risk of brute-force and credential stuffing attacks\n    \n- Unauthorized access to user or administrative accounts\n    \n- Privilege escalation through compromised credentials\n    \n- Degradation of the overall security posture of the platform\n    \n\n---\n\n## Mitigation\n\n- Enforce a strong password policy (e.g., minimum of 12 characters with uppercase, lowercase, digits, and special characters).\n    \n- Block the use of commonly known weak passwords (e.g., `12345678`, `password`, `admin`, `qwerty`).","published":"2025-11-18T23:01:40.005Z","modified":"2026-10-28T02:30:32.726537849Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":{"score":0.00254,"percentile":0.16575,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"librenms/librenms","fixedVersion":"25.11.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65014.json"},{"type":"ADVISORY","url":"https://github.com/librenms/librenms/security/advisories/GHSA-5mrf-j8v6-f45g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65014"},{"type":"PACKAGE","url":"https://github.com/librenms/librenms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:32.726537849Z"}}