LibreNMS versions prior to 26.9.0 contain a stored cross-site scripting (XSS) vulnerability in the wireless.inc.php file. This vulnerability arises because wireless sensor description values obtained via SNMP are echoed into HTML without proper escaping. An attacker controlling a monitored device's SNMP agent can inject malicious JavaScript code that executes when authenticated users view the Wireless tab, potentially enabling session hijacking.
LibreNMS versions before 26.9.0 contain an SQL injection vulnerability in the notifications.inc.php component. This flaw allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter. Exploitation can lead to unauthorized reading of users' password hashes across database tables, with results stored in notifications_attribs and accessible through the application interface.
LibreNMS versions prior to 26.9.0 have a path traversal vulnerability in the nfsen_channel_common.inc.php file. This flaw allows authenticated users to read unauthorized RRD data by injecting '../' sequences into the channel parameter. Exploiting this, attackers with access to one NFSen-enabled device can view traffic and NetFlow graphs of devices outside their authorized scope. The vulnerability has a medium severity with a CVSS score of 4.3.
LibreNMS versions before 26.9.0 have a stored cross-site scripting (XSS) vulnerability in the get_oxidized_nodes_list() function. This flaw allows unescaped rendering of Oxidized API fields and SNMP sysName values, enabling attackers who control these inputs to inject malicious scripts. Such scripts execute in the browsers of users viewing the Tools Oxidized page, potentially leading to session hijacking or other client-side impacts.
LibreNMS versions prior to 26.9.0 contain an LDAP filter injection vulnerability in ldap-authorization and ad-authorization modes. This occurs because usernames are inserted into LDAP search filters without proper escaping, and authentication only verifies user existence. If REMOTE_USER is not forwarded, unauthenticated attackers can exploit this by sending a wildcard username via HTTP Basic Authorization to match all users and groups, potentially gaining administrative access.
LibreNMS versions prior to 26.9.0 have a missing authorization vulnerability in the PortsController::purge function. This flaw allows users with global read-only access to send DELETE requests to /ports/purge with the parameter purge=all, enabling them to physically delete ports without having delete privileges. The vulnerability is fixed in version 26.9.0.
LibreNMS versions through 26.9.1.1 have an authorization bypass vulnerability in the SmokePing graph authorization logic. The flaw occurs because the code checks the source probe device rather than the actual target device, allowing restricted users on a probe device to access latency graphs for arbitrary devices. This enables unauthorized viewing of latency data and enumeration of device names.
LibreNMS versions before 26.8.0 have an authentication bypass vulnerability in the REST API. This flaw allows unauthenticated attackers to access protected API endpoints by exploiting MySQL type coercion with numeric values instead of string tokens. Successful exploitation can expose device credentials and administrative features, potentially enabling remote code execution via alert templates.
CVE-2024-51092 is a critical remote code execution vulnerability in LibreNMS versions before 24.10.0. It involves OS command injection through specific PHP files: AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory(). The vulnerability allows an attacker with low privileges to execute arbitrary code without user interaction. The CVSS score is 9.1, indicating a high severity with significant confidentiality, integrity, and availability impacts.