CVE-2026-84192 in LibreNMS
Summary
by MITRE • 09/01/2026
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields that executes when authenticated users view affected pages.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The identified vulnerability represents a critical security flaw within LibreNMS versions prior to 26.3.1, specifically categorized as a stored cross-site scripting issue affecting legacy PHP templates. This weakness arises from the application's failure to properly sanitize or escape data sourced from Simple Network Management Protocol and syslog inputs before rendering them in web pages. The core technical deficiency lies in the direct output of SNMP interface descriptions and syslog program fields without adequate encoding, allowing malicious scripts to be persisted within the database rather than being executed transiently during a single request. This persistence mechanism distinguishes it as stored XSS, where the payload remains active on the server until manually removed or overwritten by legitimate data updates.
An attacker with control over any network device monitored by LibreNMS can exploit this flaw by injecting arbitrary JavaScript code into specific fields such as SNMP interface descriptions or syslog program identifiers. When an authenticated user accesses a page that displays information from these compromised devices, the browser interprets and executes the injected script within the context of the victim's session. This execution environment grants the malicious script access to sensitive cookies, session tokens, and other authentication credentials stored in the client-side storage, effectively allowing the attacker to hijack active sessions or perform actions on behalf of the legitimate user without their knowledge or consent.
The operational impact of this vulnerability is significant due to its reliance on authenticated users for exploitation. While an unauthenticated actor cannot directly trigger the script execution, they can prepare the payload by compromising a monitored device. Once executed, the attack enables full account takeover if session cookies are not properly secured with flags such as HttpOnly or Secure. Beyond credential theft, the attacker could manipulate the user interface to phish for additional credentials, redirect users to malicious sites, or deface the application's appearance. The trust relationship between LibreNMS and its monitored infrastructure is fundamentally undermined, turning a network monitoring tool into an attack vector against internal administrative accounts.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of the flaw involves insufficient validation and encoding of user-controllable input before it is stored in persistent storage, fitting the pattern described under CWE-83 for Stored XSS via indirect injection. In terms of offensive security frameworks, this attack vector corresponds to MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers JavaScript execution within a browser environment. The persistence aspect also relates to techniques involving data manipulation in monitored systems to facilitate later exploitation.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to upgrade LibreNMS to version 26.3.1 or later, where the developers have implemented proper output encoding for all SNMP-sourced and syslog-sourced data within legacy templates. For environments unable to patch immediately, administrators should consider implementing a Web Application Firewall that can detect and block XSS payloads in HTTP requests related to device configuration updates. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successful injection by restricting script execution sources. Regular auditing of monitored devices for suspicious SNMP or syslog data entries is also recommended to identify potential compromise attempts early.