CVE-2025-23200

LibreNMS versions up to 24.10.1 are vulnerable to a stored cross-site scripting (XSS) flaw (CWE-79) in the 'state' parameter of ajax_form.php. An attacker with a low-privileged account can inject malicious script content into this parameter; the payload is stored and executes immediately when another user views or interacts with the affected page. On execution, the attacker can run script in the victim's LibreNMS session, enabling unauthorized actions within the monitoring platform and exposure of data the victim can access (CVSS scope is changed, so impact can cross security contexts). All LibreNMS deployments running 24.10.1 or earlier are affected. There is no confirmed in-the-wild exploitation yet, but a public proof-of-concept exists in the vendor's GitHub advisory and EPSS assigns a high 30.9% probability of exploitation within 30 days.

What to do: Upgrade to LibreNMS 24.11.0 or later; there are no known workarounds, so patching is the primary fix. In the meantime, limit which low-privileged accounts can submit values to ajax_form.php, review stored state data and logs for injected script payloads, and consider a restrictive Content-Security-Policy as defense-in-depth. Note the flaw requires authenticated (low-privilege) access and user interaction, so prioritize patches on systems exposed to untrusted or shared users.