CVE-2020-36947
Published: 27 January 2026
Summary
CVE-2020-36947 is a high-severity SQL Injection (CWE-89) vulnerability in Librenms Librenms. Its CVSS base score is 7.1 (High).
Operationally, ranked at the 1.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
NVD Description
LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive…
more
database contents through time-based blind SQL injection.
Deeper analysisAI
CVE-2020-36947 is an authenticated SQL injection vulnerability in LibreNMS version 1.46, specifically within the MAC accounting graph endpoint. The issue, classified under CWE-89, allows attackers to manipulate the 'sort' parameter using crafted SQL injection techniques to perform time-based blind SQL injection and extract sensitive database information.
Remote attackers with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables high confidentiality impact (C:H) with low integrity impact (I:L) and no availability impact (A:N), as reflected in the CVSS v3.1 base score of 7.1, allowing them to retrieve database contents.
Advisories and additional details are available from the LibreNMS community at https://community.librenms.org/, the project's GitHub repository at https://github.com/librenms/librenms, the official site at https://www.librenms.org, VulnCheck at https://www.vulncheck.com/advisories/librenms-mac-accounting-graph-authenticated-sql-injection, and a proof-of-concept exploit at https://www.exploit-db.com/exploits/49246. The vulnerability was published on 2026-01-27T16:16:12.040.
Details
- CWE(s)