The vulnerability arises from the ajax_table.php endpoint in LibreNMS versions 25.12.0 and earlier. The application splits an IPv6 address into its address and prefix parts, but concatenates the prefix directly into an SQL statement without validation or parameterization. This allows an attacker to inject arbitrary SQL commands, leading to unauthorized read or modification of database contents. Such a flaw can compromise the confidentiality and integrity of monitoring data and could facilitate further attacks against the underlying system.

LibreNMS, the open‑source network monitoring platform, is affected when running 25.12.0 through 26.1.x. These releases contain the vulnerable ajax_table.php implementation. The issue was addressed in release 26.2.0, which removes the unparameterized query construction. Only installations of LibreNMS older than 26.2.0 need remediation.

With a CVSS score of 9.3 this flaw is considered critical, while the EPSS score of less than 1 % indicates a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to access the web interface that hosts ajax_table.php and supply a crafted IPv6 address string; the malformed prefix component can be used to inject SQL statements that the server executes. Because the flaw permits arbitrary query execution, the impact could be full database compromise if successful. The low EPSS suggests the exploit is not widely available, but the high CVSS underscores the gravity of the potential damage.