CVE-2026-84193
Received Received - Intake

Stored XSS in LibreNMS via SNMP-Sourced Data Fields

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enroll a rogue SNMP device can inject malicious JavaScript that executes when admins view affected routing and device pages, enabling credential theft and CSRF token exfiltration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84193
EUVD
EUVD-2026-69030

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
librenms librenms to 26.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LibreNMS through version 26.2.0 has a stored cross-site scripting (XSS) vulnerability in legacy PHP template pages. It occurs because SNMP-sourced data fields like BGP peer descriptions, VRF names, and process information are rendered without proper escaping. Attackers with device management or network access can inject malicious JavaScript that executes when admins view affected pages.

Detection Guidance

Check LibreNMS versions up to 26.2.0 for affected pages. Inspect SNMP-sourced fields like BGP peer descriptions, VRF names, process information, and SLA tags for suspicious JavaScript payloads. Review admin access logs for unusual activity.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts that execute when administrators view device pages. This can lead to credential theft, CSRF token exfiltration, and potential full network compromise through stolen SNMP credentials. Attackers need device management or network access to enroll a rogue SNMP device.

Compliance Impact

This vulnerability could lead to credential theft and CSRF token exfiltration, which may result in unauthorized access to sensitive data. For GDPR, this could violate principles of data protection and user privacy. For HIPAA, it may compromise protected health information if SNMP data includes such details.

Mitigation Strategies

Apply htmlspecialchars() to all SNMP-sourced data in legacy PHP templates. Restrict SNMP device enrollment to trusted sources. Monitor for unauthorized JavaScript injections in affected fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart