PatchSiren cyber security CVE debrief
CVE-2026-40457 LMS CVE debrief
A Reflected Cross-Site Scripting (XSS) vulnerability exists in LMS (LAN Management System) before commit 9c5651b in the 'dbrecover.php' and 'netremap.php' modules. The vulnerability allows an attacker to inject arbitrary JavaScript when an authenticated user clicks a crafted link, provided certain conditions are met. The CVSS score for this vulnerability is 2.1, indicating a low severity. This issue was published on June 18, 2026, and has not been modified since. Organizations using LMS should take immediate action to mitigate this vulnerability.
- Vendor
- LMS
- Product
- Unknown
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-18
- Original CVE updated
- 2026-06-22
- Advisory published
- 2026-06-18
- Advisory updated
- 2026-06-22
Who should care
Administrators and users of LMS (LAN Management System) should be aware of this vulnerability and take necessary actions to protect their systems. This vulnerability requires authenticated users to click on a crafted link, making it a relatively low-risk attack vector.
Technical summary
The Reflected Cross-Site Scripting (XSS) vulnerability exists in the 'dbrecover.php' and 'netremap.php' modules of LMS (LAN Management System) before commit 9c5651b. The vulnerability occurs due to unsanitized GET parameters being directly embedded into HTML output. An attacker can inject arbitrary JavaScript code when an authenticated user clicks on a crafted link. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.
Defensive priority
Low
Recommended defensive actions
- Update LMS to the latest version or apply the patch (commit 9c5651b) to fix the vulnerability.
- Restrict access to the 'dbrecover.php' and 'netremap.php' modules to only trusted users.
- Implement input validation and sanitization for GET parameters in the affected modules.
- Use a Web Application Firewall (WAF) to detect and prevent XSS attacks.
- Educate users on the risks of clicking on suspicious links, even if they appear to come from trusted sources.
- Regularly review and update LMS to ensure the latest security patches are applied.
Evidence notes
The information provided is based on data from the National Vulnerability Database (NVD) and other reliable sources. The CVE record and NVD detail pages provide further information on this vulnerability.
Official resources
public