Stored XSS in LibreNMS SNMP and Syslog Data Processing

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields that executes when authenticated users view affected pages.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

LibreNMS before version 26.3.1 fails to properly escape user-controlled data from monitored network devices, creating a stored cross-site scripting (XSS) vulnerability in legacy PHP templates. Attackers who have control over monitored devices can inject malicious JavaScript through SNMP interface descriptions or syslog program fields. When authenticated administrators or operators view pages displaying this data, the injected scripts execute in their browsers with full session privileges. This affects organizations running vulnerable LibreNMS instances that monitor untrusted or compromised network infrastructure, potentially compromising the accounts of all users who access affected monitoring dashboards.

Casky's 323 mapped skills leverage Claude AI with extended reasoning to detect the attack patterns associated with this vulnerability across MITRE ATT&CK's Initial Access (TA0001) and Persistence (TA0043) techniques. Practitioners using Casky would identify suspicious patterns including: JavaScript payloads appearing in SNMP interface name fields or syslog program identifiers, stored XSS signatures in network device configuration data, and session hijacking attempts following admin access to compromised monitoring pages. The platform's skills help correlate device compromise indicators with subsequent malicious script execution, revealing the attacker's progression from initial device control through stored payload injection to session hijacking of privileged users—enabling detection before widespread lateral movement occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-84192.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-84192

Casky has 323 skills that investigate the attack patterns behind CVE-2026-84192. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn