OpenNMS EUVD-2026-75729

Exploitation requires a valid OpenNMS user account with at least ROLE_USER privileges - the lowest default role, commonly assigned to read-only staff and automated service accounts. The attacker must be able to reach the OpenNMS REST API endpoint POST /rest/reports/{id} over the network. The two vulnerable reports (AssetManagementMaintExpired and AssetManagementMaintStrategy) must be present on the instance, which they are in all default deployments. No non-default configuration, special feature flag, or elevated privilege beyond ROLE_USER is required. Exploitation is bounded by: (1) the requirement for a valid authenticated session (PR:L) - unauthenticated exploitation is not possible; (2) the read-only nature of the injected SQL - direct data modification via this path is not established; and (3) the vendor's stated deployment model of internal-network-only, which limits external exposure but does not protect against insiders or attackers who have already achieved a foothold.

The vendor-assigned CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is a well-calibrated assessment of this vulnerability. Authentication as ROLE_USER is the single meaningful barrier - it is the lowest built-in role in OpenNMS, routinely assigned to read-only monitoring staff and service accounts. Attack complexity is genuinely low once authenticated: two specific default-enabled report IDs and the injectable parameter name are now publicly documented in the patch diff. The read-only nature of the injection (I:N/A:N) limits direct write-side damage, but C:H is fully justified because the OpenNMS database stores SNMP community strings and credentials for every device under management, yielding a network-wide credential cache from a single low-privilege SQL read. No EPSS data, no CISA KEV listing, and no standalone POC are present in the input data, so exploitation probability cannot be precisely quantified; however, the transparent patch diff effectively serves as a vulnerability blueprint. The vendor's deployment guidance that Meridian and Horizon should be on internal networks reduces external exposure but does not address the insider or pivot-attacker scenario, which is the realistic threat model here.

An attacker holding a low-privilege ROLE_USER credential - for example, a compromised read-only monitoring account or a malicious insider - issues a POST request to /rest/reports/AssetManagementMaintExpired with a DATE_FORMAT value such as 'YYYY') UNION SELECT community_string FROM snmpinterface-- that closes the to_date() string argument and injects a UNION-based payload. JasperReports substitutes the value literally into the PostgreSQL query before execution, returning SNMP community strings and device credentials embedded in the rendered report. The attacker uses those credentials to authenticate directly to monitored network infrastructure, pivoting laterally across the managed environment.