CVE-2024-49754

LibreNMS, an open-source PHP/MySQL/SNMP network monitoring system, contains a stored cross-site scripting (XSS) flaw (CWE-79) in its API-Access page. An authenticated user with low privileges can embed arbitrary JavaScript in the token field when creating a new API token; the payload is saved and later executes in the browsers of other users who view that page, requiring user interaction to trigger. Successful exploitation runs attacker-supplied code in the context of other users' sessions, which can lead to account compromise and unauthorized actions within the monitoring platform. All LibreNMS deployments running versions prior to 24.10.0 are affected. The flaw is not yet in CISA's KEV catalog, but a public advisory exists and EPSS assigns a high 71.1% probability of exploitation within 30 days (99th percentile), indicating elevated near-term risk.

What to do: Upgrade to LibreNMS 24.10.0 or later. Until patched, restrict API token creation to trusted users and review existing tokens for unexpected or script-bearing values, removing or rotating any suspicious ones. Because injected scripts execute in other users' sessions, also review user activity logs for unexpected actions following recent token creation.