Nozomi Networks Guardian CVE-2025-40886

Requires an authenticated session with a low-privilege account (PR:L) on the web interface of Nozomi Networks Guardian or CMC; the attack targets a specific unvalidated input parameter within the Alert functionality. Limiting factors that reduce real-world exploitability: valid credentials are mandatory (no unauthenticated path), high attack complexity (AC:H) and a present attack requirement (AT:P) indicate success depends on conditions the attacker does not fully control, and these appliances are typically deployed on segmented OT/monitoring networks rather than internet-exposed, further narrowing the realistic attacker population to insiders or those who have already gained a foothold.

This is a meaningful but not emergency-grade issue. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) scores 7.7 (High) and reflects a network-reachable SQL injection, but three factors temper real-world risk: it requires authentication (PR:L - an existing low-privilege account), it carries high attack complexity (AC:H) plus a present attack requirement (AT:P), meaning exploitation depends on conditions outside the attacker's control rather than being a trivial push-button attack. Impact is severe where it applies (VC:H/VI:H/VA:H - full confidentiality, integrity, and availability compromise of the database) but scope is unchanged (SC:N/SI:N/SA:N), so impact is confined to the application's DBMS. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. EPSS was not provided and should not be assumed. Net: a legitimate patch priority for organizations running these OT/IoT monitoring appliances - especially because the affected products sit in sensitive industrial/critical-infrastructure networks - but the authentication requirement and high complexity make it a lower urgency than an unauthenticated RCE. The vendor (Nozomi) both reported and advised on the issue, which raises confidence in the finding's validity.

An attacker who already holds a low-privilege account on a Nozomi Networks Guardian or CMC web interface submits a crafted value to the vulnerable input parameter in the Alert functionality, injecting SQL that the application passes unsanitized to its database. Because the flaw is network-reachable but requires valid credentials and specific conditions (AC:H/AT:P), the realistic actor is a malicious insider or an attacker who has already obtained limited credentials (e.g., via phishing or reuse). No public exploit code was identified at time of analysis.