{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/librenms--24.9.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2025-66850"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LibreNMS (\u003c= 24.9.1)"],"_cs_severities":["medium"],"_cs_tags":["xss","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["LibreNMS"],"content_html":"\u003cp\u003eCVE-2025-66850 is a reflected Cross-Site Scripting (XSS) vulnerability in the LibreNMS routing module. The vulnerability exists within the 'protocol' parameter of the '/routing' endpoint. Insufficient input validation and the failure to perform HTML entity encoding allow an attacker to inject and execute arbitrary JavaScript in the browser of an authenticated user. This vulnerability affects LibreNMS versions up to and including 24.9.1. An undocumented fix was included in version 24.10.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote attacker to execute malicious scripts in the victim's browser session. Observed and theoretical impacts include the harvesting of session cookies, creation of unauthorized administrative accounts, or redirection of users to attacker-controlled domains.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch LibreNMS instances by upgrading to version 24.10.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for requests containing script tags or common XSS payloads targeting the '/routing' endpoint.\u003c/li\u003e\n\u003cli\u003eAudit sessions of administrative users if the environment remained unpatched.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T16:45:29Z","date_published":"2026-10-25T16:45:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-librenms-xss/","summary":"LibreNMS versions through 24.9.1 are vulnerable to a reflected cross-site scripting (XSS) attack via the routing module, enabling remote attackers to execute arbitrary JavaScript in the context of an authenticated user session.","title":"LibreNMS: Reflected Cross-Site Scripting (CVE-2025-66850)","url":"https://feed.craftedsignal.io/briefs/2026-10-librenms-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - LibreNMS (\u003c= 24.9.1)","version":"https://jsonfeed.org/version/1.1"}