Nozomi Guardian CVE-2025-40885

Exploitation requires an authenticated account with limited privileges (PR:L) on the Nozomi Guardian or CMC web application, plus access to the Smart Polling functionality whose input parameter is improperly validated. The CVSS 4.0 vector sets AC:H and AT:P, indicating the attacker must satisfy specific conditions beyond simply sending a request - reducing reliability and ruling out trivial unauthenticated exploitation. Impact is strictly confidentiality (read-only arbitrary SELECT statements); the flaw does not permit data modification or denial of service. Limiting factors: valid credentials are mandatory, the vulnerable Smart Polling feature must be reachable/configured, and the elevated complexity constrains opportunistic mass exploitation.

This is a moderate-risk, read-only SQL injection (CWE-89) affecting the Smart Polling feature of Nozomi Networks Guardian and CMC OT/ICS monitoring appliances. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N) indicates a network-reachable flaw but with meaningful friction: high attack complexity (AC:H), a present attack requirement (AT:P), and low-privilege authentication (PR:L). Impact is confined to confidentiality (VC:H) - the attacker can run arbitrary SELECT statements to read unauthorized data, but cannot modify or destroy it (VI:N/VA:N), and there is no scope change. The EPSS score is low (0.24%, 14th percentile), consistent with no KEV listing and no public exploit, reinforcing that this is not a mass-exploited or wormable issue. Signals are internally consistent: a low EPSS, authenticated access requirement, elevated complexity, and read-only impact together argue against treating this as a top-tier emergency. It should be prioritized according to how exposed the affected appliances are and the sensitivity of the monitored OT data, rather than as a critical drop-everything patch.

An attacker who already holds a low-privilege account on a Nozomi Guardian or CMC web interface crafts malicious input to an unsanitized Smart Polling parameter, injecting SQL that the backend DBMS executes. Through blind or union-based SELECT extraction they read database contents they are not authorized to see - potentially credentials, configuration, or sensitive OT/network telemetry. No public exploit code is identified at time of analysis, and the high attack complexity means the attacker must satisfy specific conditions to reliably trigger the flaw.