CVE-2020-15876 LibreNMS CVE debrief

Who should care

Administrators and users of LibreNMS 1.65, security teams monitoring for SQL injection vulnerabilities, and developers of affected components should be aware of this vulnerability and take necessary actions to mitigate it. This includes inventorying and verifying the version of LibreNMS in use, restricting access to the /ajax_table.php API endpoint, implementing input validation and sanitization for user-supplied parameters, and monitoring for suspicious activity. Additionally, users should update LibreNMS to version 1.65.1 or later if available. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and rollback/change windows should be tracked, and exceptions should be documented before closing the item. Monitoring, detection, and logs for exposed assets should be reviewed for extra review. Source tracking should also be implemented to verify affected scope and severity. Vulnerability management and security teams should prioritize this vulnerability due to its high CVSS score and potential impact on the system. Affected operator and platform contexts should be reviewed to ensure proper mitigation. Defensive impact and source-grounded technical framing should be considered when implementing mitigations. Evidence limits and known and unknown affected scope should be documented to ensure proper verification of mitigations. Defenders should verify the vulnerability and implement necessary controls to prevent exploitation. The CVE record and official advisory should be reviewed to validate affected scope, severity, and vendor guidance. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Asset inventory and rollback/change windows should be tracked, and exceptions should be documented before closing the item. Monitoring, detection, and logs for exposed assets should be reviewed for extra review. Source tracking should also be implemented to verify affected scope and severity. Vulnerability management and security teams should prioritize this vulnerability due to its high CVSS score and potential impact on the system. Affected and C

Technical summary

CVE-2020-15876 is a SQL injection vulnerability in LibreNMS 1.65. An authenticated attacker with normal privileges can exploit this via the sort parameter in the /ajax_table.php API endpoint, affecting multiple components. The CVSS score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). This vulnerability allows attackers to extract all information from the LibreNMS database. The vulnerability affects multiple components in the includes/html/table directory, including address-search.inc.php, alertlog.inc.php, arp-search.inc.php, as-selection.inc.php, bills.inc.php, device_mibs.inc.php, device_oids.inc.php, edit-ports.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, mibs.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, tnmsneinfo.inc.php, and toner.inc.php.

Defensive priority

Authenticated attackers with normal privileges can exploit this vulnerability to extract all information from the LibreNMS database via SQL injection.

Recommended defensive actions

• Inventory and verify the version of LibreNMS in use
• Restrict access to the /ajax_table.php API endpoint
• Implement input validation and sanitization for user-supplied parameters
• Monitor for suspicious activity and update LibreNMS to version 1.65.1 or later if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2020-15876 record indicates a SQL injection vulnerability in LibreNMS 1.65. An authenticated attacker with normal privileges can exploit this via the sort parameter in the /ajax_table.php API endpoint. This affects multiple components in the includes/html/table directory. Official records show CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 8.8.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.