LibreNMS EUVD-2026-97657

Exploitation requires the attacker to control the content of the Oxidized API response OR a monitored device's SNMP sysName value - i.e. a compromised/rogue device on the monitored network or the ability to tamper with the Oxidized integration's data. The payload only triggers when an authenticated LibreNMS user navigates to the Tools > Oxidized node list page (UI:P / passive user interaction), and only when the Oxidized integration is configured and in use, which limits exposure to deployments that actually run Oxidized. Limiting factors: requires a privileged network position or device control to seed the payload, requires a victim to view the specific page, and requires the Oxidized feature to be enabled - it is not remotely triggerable against an arbitrary default install.

This is a medium-severity stored XSS (CWE-79) in LibreNMS, scored 5.3 via a CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) that reports no impact to the vulnerable system (VC:N/VI:N/VA:N) but low confidentiality and integrity impact to a subsequent system (SC:L/SI:L) - consistent with script executing in a victim's browser rather than compromising the LibreNMS host directly. All exploitation signals point to low-to-moderate real-world priority: there is no CISA KEV listing, no public exploit code identified, and no EPSS score was provided in the input, so exploitation probability cannot be quantified. The PR:N / UI:P combination means no LibreNMS authentication is needed to plant the payload, but a logged-in user (typically an operator) must actively view the Tools > Oxidized page for the script to fire, which bounds the blast radius. A notable nuance: although PR:N marks the injection as unauthenticated, exploitation realistically requires the attacker to control either the Oxidized API response or a monitored device's SNMP sysName - i.e. a position on the monitored network or a man-in-the-middle/compromised device - so this is better characterized as a trusted-input-boundary flaw than a trivially internet-exposed one. Net assessment: a legitimate issue to patch on normal cadence, not an emergency; it is a high-CVSS-perception-but-contextually-constrained web vuln whose impact is operator-browser session rather than server takeover.

An attacker who has compromised a monitored device (or can tamper with its SNMP sysName or the Oxidized API response) injects a malicious script into one of those fields. When a LibreNMS operator opens the Tools > Oxidized node list page, the unescaped value renders and the script executes in their authenticated browser session, enabling session theft or actions in the LibreNMS UI. No public exploit code was identified at time of analysis.