Stored Cross-Site Scripting in LibreNMS Affects Wireless Device Monitoring

CVE-2026-109352

What is CVE-2026-109352?

LibreNMS prior to version 26.9.0 is vulnerable to a stored cross-site scripting (XSS) flaw found in the 'device/wireless.inc.php' file. The vulnerability occurs when values from monitored wireless sensors, specifically those populated from SNMP DisplayString fields, are echoed into HTML without proper escaping. This enables attackers who have control over a device's SNMP agent to inject malicious JavaScript into these values. When authenticated users access the Wireless tab of the device view, the injected script executes, potentially leading to session hijacking and security breaches.

References