CyberRota Analysis
AI-GeneratedLibreNMS versions up to 26.4.0 are vulnerable to stored cross-site scripting due to improper handling of JSON fields from an admin-configurable Oxidized integration URL. This flaw allows an attacker to exploit the SSRF vulnerability by pointing the Oxidized URL to a malicious server, potentially compromising all users who access the affected device's showconfig page. Organizations using LibreNMS should prioritize upgrading to version 26.7.0 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at an attacker-controlled server (SSRF) can cause it to return malicious JSON, resulting in stored/persistent cross-site scripting affecting all users who view any device's showconfig tab. Fixed in 26.7.0.