LibreNMS CVE-2025-62412

Exploitation requires an authenticated LibreNMS account with privileges to create or edit alert rules (CVSS PR:H, i.e. an administrator), who submits a malicious rule name via POST to /ajax_form.php on the Alerts > Alert Rules page. The server-side strip_tags() filter must be bypassed, which the advisory shows is possible using XML character references (e.g. &lt;script>alert(1)&lt;/script>). The payload is stored and only fires when a victim user subsequently loads the Alert Rules page (UI:R - requires victim interaction). Limiting factors: high privilege needed to inject, victim must browse the vulnerable page, and only versions <= 25.8.0 are affected (patched in 25.10.0). These constraints make the practical attacker a malicious or compromised privileged user targeting another admin, not an unauthenticated remote attacker.

This is a genuinely low-priority issue despite being a network-facing XSS. The CVSS base score is only 4.8 (NVD) / 4.3 (vendor GHSA), firmly in the Medium band, and every independent signal reinforces low urgency: EPSS is 0.28% (19th percentile), and the flaw is NOT in CISA KEV (no confirmed active exploitation). The most decisive factor is PR:H - the attacker must already be an authenticated, high-privileged LibreNMS user (one able to create/manage alert rules, effectively an admin) to inject the payload, which sharply limits the escalation value since such a user already holds broad control over the monitoring platform; the realistic threat is one privileged user attacking another admin's session, not an external attacker. A public POC does exist (Trend Micro ZDI, ZDI-CAN-28105, with a downloadable POC file), so 'publicly available exploit code exists' - but POC availability is distinct from active exploitation, and no exploitation in the wild is confirmed. Note a data conflict to verify: NVD scores the vector as S:C/A:N (4.8) while the vendor GHSA advisory uses S:U/C:L/I:L/A:L (4.3) - the scope-change and availability-impact metrics disagree between the two sources. Net: a real but low-severity, high-privilege-gated stored XSS; patch in routine cycles, not an emergency.

A privileged LibreNMS user with alert-rule management rights navigates to Alerts > Alert Rules and creates a rule whose name contains an HTML/JavaScript payload, submitted via a POST to /ajax_form.php; the server's strip_tags() sanitization is bypassed using XML character references. When another administrator later opens the Alert Rules page, the stored payload executes in their browser session. A public POC from Trend Micro's Zero Day Initiative (ZDI-CAN-28105) is available.