LibreNMS EUVD-2026-97654

Exploitation requires the attacker to control the SNMP agent of a device actively monitored by the target LibreNMS instance (e.g., a compromised, rogue, or malicious monitored device) and to set wireless sensor DisplayString fields - the description names AI-AP-MIB::aiSSID - to a JavaScript payload; LibreNMS must ingest this via its discovery/polling of that device. The stored payload only fires when an authenticated LibreNMS user navigates to that specific device's Wireless tab (UI:P), so a logged-in victim action is mandatory. Limiting factors: affected only on versions before 26.9.0; attacker needs pre-existing control over monitored-device SNMP data (not LibreNMS credentials); impact is confined to the victim's authenticated session rather than direct server compromise.

This is a medium-severity stored XSS (CVSS 4.0 base 5.3) whose real-world urgency is materially lower than the CVSS number alone might suggest, because exploitation depends on an unusual precondition. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, impact VC:N/VI:N/VA:N but subsequent-system SC:L/SI:L) correctly models this as network-reachable with no LibreNMS authentication required of the attacker, but requiring victim interaction (an authenticated operator opening the Wireless tab) and producing only limited confidentiality/integrity impact on a subsequent system (the victim's authenticated browser session). The critical caveat the PR:N metric obscures is that the attacker must already control the SNMP agent of a device that the target LibreNMS instance actively monitors - a significant positioning requirement that makes widespread, opportunistic exploitation unlikely and points toward targeted/insider or supply-chain-of-monitoring scenarios. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; treat this as a defense-in-depth patch priority (monitoring systems are high-value, so session hijacking of an admin is meaningful) rather than an emergency. Net: a genuine but conditional issue, not a high-urgency internet-facing RCE-class flaw.

An attacker who controls (or has compromised) a device monitored by LibreNMS configures its SNMP agent to return a malicious JavaScript payload in a wireless sensor DisplayString field such as AI-AP-MIB::aiSSID. LibreNMS stores this value during its discovery/polling cycle and later renders it unescaped on the device's Wireless tab, so the script executes in the browser of any authenticated user who views that tab, enabling session hijacking. No public exploit was identified at time of analysis, and the attack requires both control of a monitored device's SNMP data and an authenticated victim viewing the affected page.