CVE-2026-109352
Received Received - Intake

Stored XSS in LibreNMS Wireless Sensor Display

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device's SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device's Wireless tab, enabling session hijacking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109352
EUVD
EUVD-2026-97654

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
librenms librenms 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LibreNMS before version 26.9.0 has a stored cross-site scripting (XSS) vulnerability in the wireless sensor display functionality. The issue occurs because wireless sensor descriptions from SNMP DisplayString fields are echoed into HTML without proper escaping. Attackers who control a monitored device's SNMP agent can inject malicious JavaScript into fields like AI-AP-MIB::aiSSID. When authenticated users view the device's Wireless tab, the injected script executes, potentially allowing session hijacking.

Detection Guidance

Check LibreNMS version with 'php -r "include(\"includes\/defines.inc.php\"); echo $config['version'];"' or via the web interface. Inspect device wireless tabs for unexpected JavaScript in sensor values. Review SNMP DisplayString fields for suspicious payloads in wireless sensors.

Impact Analysis

If you use LibreNMS to monitor network devices, an attacker with access to a monitored device's SNMP agent could inject malicious scripts. When you view the device's Wireless tab in LibreNMS, the script could execute in your browser, potentially stealing your session cookies or sensitive data. This could lead to unauthorized access to your LibreNMS account or other systems.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by exposing sensitive data through session hijacking. GDPR requires protection of personal data, and a breach could lead to unauthorized access. HIPAA mandates safeguards for protected health information, and this vulnerability could compromise those safeguards if session data is stolen.

Mitigation Strategies

Upgrade LibreNMS to version 26.9.0 or later. Sanitize SNMP DisplayString inputs by escaping HTML in wireless sensor values. Monitor for unauthorized changes in SNMP agent configurations on monitored devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109352. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart