CVE-2020-15878 LibreNMS CVE debrief

Who should care

Administrators and users of LibreNMS 1.65, security teams monitoring for SQL injection vulnerabilities, and organizations using LibreNMS for network management should be aware of this vulnerability. They should verify their system patch levels, restrict access to the /ajax_table.php API endpoint, and implement input validation and sanitization for the address parameter to prevent exploitation.

Technical summary

CVE-2020-15878 is an authenticated SQL injection vulnerability in LibreNMS 1.65. The vulnerability exists in the address parameter of the /ajax_table.php API endpoint. An attacker with normal privileges can exploit this vulnerability to extract all information from the LibreNMS database, potentially leading to unauthorized data access and manipulation. To verify, defenders should check official vendor advisories, review system logs for suspicious database queries, and confirm system patch levels. The vulnerability allows an attacker to inject malicious SQL code, potentially leading to data breaches and unauthorized system modifications. Security teams should prioritize patching affected systems and implement additional security measures to prevent exploitation.

Defensive priority

Authenticated attackers with normal privileges can exploit this vulnerability to extract all information from the LibreNMS database.

Recommended defensive actions

• Inventory and verify LibreNMS installations for version 1.65
• Restrict access to the /ajax_table.php API endpoint
• Implement input validation and sanitization for the address parameter
• Monitor for suspicious database queries
• Apply vendor remediation when available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; verify with primary official records. The CVE details an authenticated SQL injection vulnerability in LibreNMS 1.65 via the address parameter in the /ajax_table.php API endpoint. To verify, defenders should check official vendor advisories, review system logs for suspicious database queries, and confirm system patch levels.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.