EUVD-2026-69028
GHSA-3cvh-rhc6-7rhc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no LibreNMS privileges (PR:N); stored XSS crosses session boundary (S:C); victim must view VRF page (UI:R); no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary JavaScript through SNMP responses that executes in the browser of any user viewing VRF-related pages.
AnalysisAI
Stored cross-site scripting in LibreNMS before 26.5.0 allows an attacker who controls any SNMP-monitored network device to inject persistent JavaScript into the LibreNMS web interface via poisoned VRF-related SNMP fields. The injected payload executes in the browser of any LibreNMS user who views VRF display pages, enabling session hijacking, credential theft, or UI redressing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: (1) the attacker must control a network device - either by compromising it or operating a rogue device - that is actively monitored by the target LibreNMS instance via SNMP polling; (2) the LibreNMS instance must be monitoring MPLS VPN infrastructure such that VRF data (mplsVpnVrfDescription, vrf_name, mplsVpnVrfRouteDistinguisher) is being collected and the VRF display pages are rendered for users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P captures the indirect exploitation model: the attacker requires no privileges on LibreNMS itself, but does require control over a network device actively monitored by the target instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade LibreNMS to version 26.5.0 or later, which resolves the unsanitized rendering of SNMP-sourced VRF fields. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 7.2), this vulnerability is remotely exploit
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. Rate
An issue was discovered in LibreNMS through 1.47. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
An issue was discovered in LibreNMS through 1.47. Rated critical severity (CVSS 9.1), this vulnerability is remotely exp
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database informatio
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated high severity (CVSS 8.8), this vulnera
An issue was discovered in LibreNMS before 1.65.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
An issue was discovered in LibreNMS 1.50.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 8.8), this vulnerability is remotely exploit
Command injection in LibreNMS's Virtualization Discovery module enables authenticated administrator-level users to execu
Remote code execution in LibreNMS network monitoring platform (versions prior to 26.3.0) allows authenticated administra
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today