Skip to content
Threat Feed
Subscribe
medium advisory

LibreNMS: Reflected Cross-Site Scripting (CVE-2025-66850)

LibreNMS versions through 24.9.1 are vulnerable to a reflected cross-site scripting (XSS) attack via the routing module, enabling remote attackers to execute arbitrary JavaScript in the context of an authenticated user session.

CVE search metadata

CVE search record: CVE-2025-66850. KEV: no. Product: LibreNMS (<= 24.9.1). Brief: LibreNMS: Reflected Cross-Site Scripting (CVE-2025-66850). Brief link: https://feed.craftedsignal.io/briefs/2026-10-librenms-xss/

Triage facts

Revision 1
Applicability
LibreNMS (<= 24.9.1)
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 25, 16:45 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

CVE-2025-66850 is a reflected Cross-Site Scripting (XSS) vulnerability in the LibreNMS routing module. The vulnerability exists within the 'protocol' parameter of the '/routing' endpoint. Insufficient input validation and the failure to perform HTML entity encoding allow an attacker to inject and execute arbitrary JavaScript in the browser of an authenticated user. This vulnerability affects LibreNMS versions up to and including 24.9.1. An undocumented fix was included in version 24.10.0.

Impact

Successful exploitation allows a remote attacker to execute malicious scripts in the victim's browser session. Observed and theoretical impacts include the harvesting of session cookies, creation of unauthorized administrative accounts, or redirection of users to attacker-controlled domains.

Recommendation

  • Patch LibreNMS instances by upgrading to version 24.10.0 or later immediately.
  • Review web server access logs for requests containing script tags or common XSS payloads targeting the '/routing' endpoint.
  • Audit sessions of administrative users if the environment remained unpatched.

Immediate actions

Upgrade LibreNMS to version 24.10.0 or later

IT Operations 48h

Threat Hunt

Identify past exploitation attempts by scanning web access logs for common XSS patterns in the /routing endpoint

T1190 medium medium confidence hunt now

Data: Web server access logs

Mitigations

Upgrade LibreNMS to 24.10.0

immediate IT Operations

CVE-2025-66850

Detection coverage 1

Detect CVE-2025-66850 Exploitation Attempt

medium

Detects exploitation attempts against the LibreNMS routing module by searching for script tags in the protocol parameter

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →