LibreNMS CVE-2026-84192

Exploitation requires the attacker to control a network device actively monitored by the target LibreNMS instance - achieved by compromising an enrolled device, spoofing a syslog sender permitted by source filtering, or introducing a rogue device accepted into SNMP polling scope. No LibreNMS account credentials are required. Payload execution is contingent on an authenticated LibreNMS user navigating to an affected page (alerts, health dashboards, syslog viewer, pseudowires page, or VRF routing page) after the malicious data has been polled and stored. Factors that limit exploitation: SNMP access controls and community string enforcement preventing unauthorized devices from responding to polls; syslog source-IP filtering blocking rogue senders; network segmentation isolating the SNMP management plane from attacker-reachable segments; and the requirement that a privileged user actively browses an affected page rather than exploitation occurring passively.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N) accurately reflects a network-reachable, low-complexity path requiring no LibreNMS privileges but demanding attacker control over a polled device - a meaningful prerequisite that materially reduces exposure compared to a direct unauthenticated attack. The UI:P constraint further limits triggering to authenticated user page views. EPSS data was not provided in the source intelligence, and the CVE is absent from CISA KEV, meaning exploitation probability and active targeting remain unquantified rather than confirmed low. The multi-location attack surface (five or more distinct template sinks) and the high confidentiality impact from session hijacking potential elevate real-world priority above what the raw 7.1 score might suggest for well-resourced operations teams; the absence of KEV listing should not be interpreted as absence of targeting. No conflicting signals between CVSS vector and description were identified - the network attack vector is consistent with SNMP/syslog data injection from a remotely accessible device.

An attacker who has compromised a network switch already enrolled in LibreNMS SNMP polling sets the device's ifAlias (port description) OID to a JavaScript payload designed to exfiltrate session cookies to an attacker-controlled server. LibreNMS polls the device on its next cycle and stores the unescaped value in the ports table. When any authenticated LibreNMS administrator next opens the Alerts page, the browser executes the script and sends the session token to the attacker, granting full platform access. No public exploit code has been identified, but the attack requires only standard SNMP MIB manipulation - no exploitation framework is needed.