CVE-2020-36947
Published: 27 January 2026
Summary
CVE-2020-36947 is a high-severity SQL Injection (CWE-89) vulnerability in Librenms Librenms. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 3.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2020-36947 is an authenticated SQL injection vulnerability in LibreNMS version 1.46, specifically within the MAC accounting graph endpoint. The issue, classified under CWE-89, allows attackers to manipulate the 'sort' parameter using crafted SQL injection techniques to perform time-based blind SQL injection and extract sensitive database information.
Remote attackers with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables high confidentiality impact (C:H) with low integrity impact (I:L) and no availability impact (A:N), as reflected in the CVSS v3.1 base score of 7.1, allowing them to retrieve database contents.
Advisories and additional details are available from the LibreNMS community at https://community.librenms.org/, the project's GitHub repository at https://github.com/librenms/librenms, the official site at https://www.librenms.org, VulnCheck at https://www.vulncheck.com/advisories/librenms-mac-accounting-graph-authenticated-sql-injection, and a proof-of-concept exploit at https://www.exploit-db.com/exploits/49246. The vulnerability was published on 2026-01-27T16:16:12.040.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30862
Vulnerability details
LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive…
more
database contents through time-based blind SQL injection.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated SQL injection in a network-accessible application (LibreNMS) directly enables T1190 for initial exploitation and T1213.006 for extracting database contents via blind SQLi.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of the 'sort' parameter in the MAC accounting graph endpoint to block crafted time-based blind SQL injection payloads.
Restricts the database privileges granted to the low-privilege authenticated account used to reach the vulnerable endpoint, limiting data extraction even if injection succeeds.
Enables monitoring of application and database query patterns to identify anomalous time-based blind SQL injection attempts against the MAC accounting endpoint.