LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless… (CVE-2026-109352)

The vulnerability in LibreNMS before version 26.9.0 is a stored cross-site scripting flaw located in includes/html/pages/device/wireless.inc.php. It occurs because wireless sensor description values, populated from SNMP DisplayString fields during device discovery, are output into the HTML interface without escaping. An attacker with control over a device's SNMP agent can set fields such as AI-AP-MIB::aiSSID to malicious JavaScript. When an authenticated user accesses the Wireless tab for that device, the injected script executes, leading to possible session hijacking.

Successful exploitation allows an attacker controlling a monitored device's SNMP agent to inject malicious JavaScript that executes in the context of authenticated users viewing the Wireless tab. This can lead to session hijacking and compromise of user accounts. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the LibreNMS interface to trusted users only and avoid viewing the Wireless tab for untrusted devices. Monitor the vendor's announcements for patches addressing this vulnerability.