CVE-2026-109352 Overview
CVE-2026-109352 is a stored cross-site scripting (XSS) vulnerability in LibreNMS versions before 26.9.0. The flaw resides in includes/html/pages/device/wireless.inc.php, which renders wireless sensor sensor_descr values into HTML without output encoding. These values originate from SNMP DisplayString fields collected during device discovery. An attacker who controls the SNMP agent on a monitored device can inject JavaScript payloads into fields such as AI-AP-MIB::aiSSID. The script executes in the browser of any authenticated user who views the device's Wireless tab, enabling session hijacking and actions in the LibreNMS UI performed under the victim's privileges [CWE-79].
Critical Impact
Attackers controlling a monitored SNMP agent can hijack authenticated LibreNMS sessions when operators view a device's Wireless tab.
Affected Products
- LibreNMS versions prior to 26.9.0
- Deployments monitoring untrusted or attacker-controlled SNMP agents
- Instances using the device Wireless tab for sensor visualization
Discovery Timeline
- 2026-10-12 - CVE-2026-109352 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109352
Vulnerability Analysis
LibreNMS collects wireless sensor metadata through SNMP polling and stores sensor_descr values in its database. The wireless.inc.php page echoes these values directly into HTML markup without HTML entity encoding. When an authenticated user navigates to the Wireless tab for a device, the browser parses attacker-supplied markup as part of the trusted LibreNMS origin. This gives injected scripts access to session cookies, CSRF tokens, and the full LibreNMS API surface authorized for the viewing user. Because the payload is stored, every user who opens the affected device page re-triggers execution without further attacker interaction.
Root Cause
The root cause is missing contextual output escaping on SNMP-derived strings. LibreNMS treats DisplayString values from AI-AP-MIB and similar MIBs as safe data, but the SNMP protocol does not constrain these fields to printable or non-HTML characters. Rendering untrusted data in an HTML context without htmlspecialchars() or an equivalent escaping routine produces the stored XSS condition.
Attack Vector
An attacker needs control over an SNMP agent that a LibreNMS instance polls. This can be a compromised network device, a rogue appliance added to the monitored estate, or a wireless access point whose configuration includes operator-controlled SSID strings. The attacker sets a wireless sensor description, for example by crafting an SSID containing a <script> tag, and waits for LibreNMS discovery to ingest the value. Exploitation completes when an authenticated administrator or NOC analyst loads the device's Wireless tab. See the GitHub Security Advisory GHSA-ffjc-4fr5-47c6 and the VulnCheck Advisory for additional technical context.
Detection Methods for CVE-2026-109352
Indicators of Compromise
- Wireless sensor descriptions containing HTML tags, javascript: URIs, or event handler attributes such as onerror= or onload=.
- Unexpected outbound requests from analyst browsers to attacker-controlled domains after visiting a device's Wireless tab.
- Session reuse from new IP addresses or user-agents shortly after a LibreNMS user accessed a suspicious device page.
Detection Strategies
- Query the LibreNMS wireless_sensors table for sensor_descr entries containing <, >, script, or on\w+= patterns.
- Review SNMP polling logs for devices returning DisplayString values with HTML metacharacters.
- Inspect web server access logs for Wireless tab requests immediately followed by anomalous API calls from the same session.
Monitoring Recommendations
- Alert on LibreNMS user session activity initiated from unexpected geolocations or client fingerprints.
- Baseline the character set used in SSID and wireless sensor descriptors, and flag deviations.
- Forward LibreNMS application and web server logs to a central analytics platform for correlation with endpoint telemetry.
How to Mitigate CVE-2026-109352
Immediate Actions Required
- Upgrade LibreNMS to version 26.9.0 or later across all instances.
- Audit existing wireless_sensors records for payloads injected before the upgrade and sanitize or purge affected rows.
- Rotate active LibreNMS session cookies and API tokens for users who may have viewed compromised device pages.
Patch Information
LibreNMS fixed the issue in release 26.9.0 by escaping sensor_descr output in includes/html/pages/device/wireless.inc.php. Patch details and the fix commit are referenced in the GitHub Security Advisory GHSA-ffjc-4fr5-47c6.
Workarounds
- Restrict SNMP polling to devices under direct administrative control until the upgrade is applied.
- Enforce SNMPv3 with authentication and encryption to limit who can set DisplayString fields on monitored devices.
- Deploy a Content Security Policy (CSP) on the LibreNMS web interface to constrain inline script execution.
- Avoid opening the Wireless tab for untrusted or newly discovered devices until records are reviewed.
# Upgrade LibreNMS to the patched release
cd /opt/librenms
sudo -u librenms git fetch --tags
sudo -u librenms git checkout 26.9.0
sudo -u librenms ./daily.sh
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
