The vulnerability is a time‑based blind SQL injection found in the address-search.inc.php file of LibreNMS. When a crafted subnet prefix is supplied through the address parameter, the prefix is concatenated into an SQL query without parameter binding, allowing an authenticated user to manipulate the query logic. By measuring response delays, an attacker can infer database contents, potentially exposing sensitive configuration and inventory data. This flaw is a classic example of SQL injection (CWE‑89).

Affected systems are instances of LibreNMS version 25.12.0 and earlier. The issue was fixed in version 26.2.0, so any deployment that has not yet applied the latest update remains vulnerable.

The CVSS score of 8.8 indicates a high severity assessment. The EPSS score is less than 1%, meaning the proportion of attacks observed is currently very low, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable only by users who can authenticate to the application; an attacker must have valid credentials but can be any authenticated user. The main risk is data disclosure through time‑based inference.