LibreNMS CVE-2026-84193

Exploitation requires one of two preconditions: (1) the attacker holds a device management role within LibreNMS with sufficient privileges to configure or enroll SNMP-polled devices, allowing direct injection of malicious data into BGP peer descriptions, VRF names, process fields, or SLA tags; or (2) the attacker has network-level access to a segment LibreNMS monitors and can deploy a rogue SNMP-speaking host whose field values LibreNMS polls and stores. In both paths, a LibreNMS administrator must subsequently navigate to one of the affected legacy PHP template pages displaying routing or device data for the stored payload to execute (UI:P). Exploitation is further constrained by high attack complexity (AC:H), indicating that specific timing or configuration preconditions must align. Exploitation is not possible without active SNMP polling of the attacker-controlled data source, and is limited to environments where legacy PHP template pages remain in use rather than any modernized rendering path.

The CVSS 4.0 score of 5.8 (Medium) is shaped primarily by high attack complexity (AC:H) and high privilege requirements (PR:H), which temper what would otherwise be a more severe confidentiality impact (VC:H). However, the PR:H rating warrants scrutiny: the description offers a second attack path - network-level enrollment of a rogue SNMP device - which may require only network positioning and not a LibreNMS account credential, effectively reducing the privilege prerequisite below what PR:H implies. This discrepancy is not resolved in available data and should be verified with the vendor advisory. No EPSS score is provided, no KEV listing exists, and no public exploit code has been identified at time of analysis, so this is not a known-weaponized issue. Real-world risk is elevated in environments where LibreNMS is deployed without network segmentation or strict SNMP community controls, where a rogue device on the monitored segment could poison the data store. The admin-interaction requirement (UI:P) is a meaningful limiting factor - exploitation is not immediate upon injection but depends on an administrator navigating affected pages.

An attacker with network access to a segment monitored by LibreNMS deploys a rogue host running an SNMP agent that returns malicious JavaScript in its BGP peer description or VRF name fields. LibreNMS polls the device, stores the payload, and when a LibreNMS administrator next navigates to the routing overview or device detail pages, the stored script executes silently in their browser, sending the administrator's session token and CSRF token to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, but the attack chain relies on well-understood stored XSS mechanics.