CVE-2026-109352GHSA-ffjc-4fr5-47c6
LibreNMS before 26.9.0 Stored XSS via wireless sensor description
librenms librenms
CVSS
5.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 26.9.0librenmsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device's SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device's Wireless tab, enabling session hijacking.
Text from CVE List
Affected versions 2
- librenmsaffected: all versions before 26.9.0CVE List
- librenmsunaffected: 26.9.0CVE List