LibreNMS (<= 24.9.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/librenms--24.9.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 16:45:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLibreNMS: Reflected Cross-Site Scripting (CVE-2025-66850)https://feed.craftedsignal.io/briefs/2026-10-librenms-xss/Sun, 25 Oct 2026 16:45:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-librenms-xss/LibreNMS versions through 24.9.1 are vulnerable to a reflected cross-site scripting (XSS) attack via the routing module, enabling remote attackers to execute arbitrary JavaScript in the context of an authenticated user session.CVE-2025-66850 is a reflected Cross-Site Scripting (XSS) vulnerability in the LibreNMS routing module. The vulnerability exists within the 'protocol' parameter of the '/routing' endpoint. Insufficient input validation and the failure to perform HTML entity encoding allow an attacker to inject and execute arbitrary JavaScript in the browser of an authenticated user. This vulnerability affects LibreNMS versions up to and including 24.9.1. An undocumented fix was included in version 24.10.0.

Impact

Successful exploitation allows a remote attacker to execute malicious scripts in the victim's browser session. Observed and theoretical impacts include the harvesting of session cookies, creation of unauthorized administrative accounts, or redirection of users to attacker-controlled domains.

Recommendation

  • Patch LibreNMS instances by upgrading to version 24.10.0 or later immediately.
  • Review web server access logs for requests containing script tags or common XSS payloads targeting the '/routing' endpoint.
  • Audit sessions of administrative users if the environment remained unpatched.
]]>mediumadvisoryxssweb-vulnerability