SNMP
CVE-2019-25298
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.1 with PoC. SNMP monitoring tools contain network topology data, device configurations, and performance metrics. |
| Exploit ScenarioDerived | An attacker exploits the SQL injection to extract network device configurations, community strings, and monitoring data from the SNMP management database. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
html5_snmp 1.11 has multiple SQL injection vulnerabilities allowing attackers to manipulate SNMP monitoring database queries.
Earlier versions of this analysis (1)
Multiple SQL injections in html5_snmp expose SNMP monitoring data.
RemediationAI
Update the software. Parameterize all SQL queries.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
html5_snmp 1.11 has multiple CWE-89 SQL injection vulnerabilities that allow attackers to inject SQL commands and extract or modify SNMP monitoring data.
Know when SNMP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
html5_snmp 1.11 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through Router_ID and Router_IP parameters. Attackers can exploit error-based, time-based, and union-based injection techniques to potentially extract or modify database information by sending crafted payloads.
Executive ViewAI
A critical SQL injection vulnerability in html5_snmp 1.11 allows attackers to manipulate database queries and potentially gain unauthorized access to sensitive data or system control. Organizations running this software face immediate risk of data breach, system compromise, and operational disruption, with active exploits already available in the wild.
Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts on Router_ID and Router_IP parameters; restrict network access to html5_snmp interface using firewall rules and VPN/bastion hosts; disable html5_snmp if operationally feasible; enable comprehensive database query logging and monitoring for suspicious activity; consider network segmentation to isolate affected systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
Hardcoded/insecure credentials in IDC SFX Series SuperFlex Satellite Receiver. Multiple accounts with known credentials
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database informatio
Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the ap
html5_snmp 1.11 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scrip
Reflected cross-site scripting in LibreNMS versions 25.12.0 and earlier allows unauthenticated remote attackers to injec
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through
Stored XSS in LibreNMS Alert Rules allows authenticated administrators to inject malicious scripts that execute when oth
Improper SNMP request parsing in Cisco Nexus 9000 Series switches running ACI mode allows authenticated remote attackers
Incorrect privilege assignment in Huawei openUBMC causes the SNMP pseudo-identity group (special_users, including the SN
Stored cross-site scripting in LibreNMS versions 24.10.0 through 26.1.1 allows authenticated users to inject malicious s