CyberRota Analysis
AI-GeneratedLibreNMS versions prior to 26.5.0 are vulnerable to stored cross-site scripting (XSS) due to unsanitized rendering of specific fields from SNMP polling on VRF display pages. This flaw allows attackers with control over monitored network devices to inject malicious JavaScript, which can execute in the browsers of users accessing these pages, potentially leading to data theft or session hijacking. Organizations using LibreNMS should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary JavaScript through SNMP responses that executes in the browser of any user viewing VRF-related pages.