CVE-2024-53457

CVE-2024-53457 is a stored cross-site scripting (XSS) flaw in the Device Settings section of the LibreNMS network monitoring platform, versions v24.9.0 through v24.10.0. An authenticated user with access to device settings can inject a crafted payload into the Display Name parameter, and the malicious script or HTML is then persistently stored and executed when other users view the affected device page. An attacker gains the ability to run arbitrary web scripts in the browsers of other LibreNMS users, under the application's origin, which can be used for session or credential theft and other client-side attacks given the low-privilege, user-interaction requirements reflected in the CVSS score. Organizations running LibreNMS v24.9.0 to v24.10.0 are affected; instances on older or newer releases fall outside the published range. A public proof-of-concept exists and EPSS assigns a high ~44% probability of exploitation within 30 days, but the flaw is not yet in CISA KEV and there is no confirmed in-the-wild exploitation.

What to do: Upgrade LibreNMS to a release newer than v24.10.0, which exits the affected range. In the meantime, restrict who can edit Device Settings, review stored device Display Names for embedded HTML/script payloads, and ensure output escaping of the Display Name field is applied if patching is delayed.