CVE-2026-109352: LibreNMS before 26.9.0 Stored XSS via wireless sensor description
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensordescr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device's SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device's Wireless tab, enabling session hijacking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreNMSto a version that resolves this vulnerability.Fixed in 26.9.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to control the SNMP agent of a device monitored by LibreNMS and set a wireless sensor description through an SNMP DisplayString field, such as AI-AP-MIB::aiSSID. No LibreNMS authentication is required for the attacker, but a user must later view the affected device's Wireless tab for the payload to execute.
Which users are at risk when a malicious value is stored?
Authenticated LibreNMS users who open the affected device's Wireless tab are exposed. The injected JavaScript can execute in their browser and may enable session hijacking.
How can I determine whether an instance is affected?
Instances running LibreNMS before version 26.9.0 are affected. Review wireless sensor sensor_descr values discovered from monitored devices, particularly values sourced from SNMP DisplayString fields, for unexpected HTML or JavaScript content.
What can be done if upgrading is not immediately possible?
Limit trust in and access to monitored devices' SNMP agents, since exploitation requires an attacker to control an agent and provide a malicious sensor description. Avoid opening the Wireless tab for devices with suspicious wireless sensor values until the instance can be updated.