Nozomi Guardian CVE-2025-40887

Exploitation requires an authenticated account with limited (low) privileges on the Guardian or CMC web application (PR:L) - it is not remotely exploitable by an unauthenticated attacker. The specific trigger is an improperly validated input parameter within the Alert functionality, so the attacker must be able to reach and submit to that feature. Impact is limited to reading data via arbitrary SELECT statements (no write or destructive capability), and the high attack complexity (AC:H) plus attack requirement (AT:P) indicate non-default or conditional circumstances that make exploitation harder and less reliable, which further constrains realistic risk.

This is a moderate-severity, authenticated SQL injection (CWE-89) in Nozomi Networks Guardian and CMC, and the signals consistently point to a lower real-world priority rather than an urgent one. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) scores 6.0 and is internally consistent with the description: network-reachable but requiring an authenticated low-privilege user (PR:L), with high attack complexity (AC:H) and a present attack requirement (AT:P), meaning exploitation is not trivially repeatable. Impact is confined to confidentiality (VC:H, VI:N, VA:N) because the flaw permits only arbitrary SELECT statements - no data modification or denial of service. The EPSS score of 0.24% (14th percentile) reinforces low near-term exploitation likelihood, there is no CISA KEV listing, and no public exploit code was identified in the provided data. No signals conflict here: a mid-range CVSS, low EPSS, no KEV, and no POC all align toward a genuine-but-non-urgent, read-only data-exposure issue gated behind authentication. The main caveat is that these are OT/ICS security-monitoring appliances where exposed data (alerts, asset inventory, network telemetry) can be sensitive, so confidentiality-only impact still warrants patching on normal cycles.

An attacker who already holds a valid low-privilege account on a Guardian or CMC web interface submits a crafted value into the vulnerable Alert-functionality input parameter, injecting arbitrary SELECT clauses that the backend DBMS executes. This lets them read database records beyond their authorization level, such as other users' alert data or configuration. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) plus attack requirement (AT:P) mean exploitation is not fully reliable out of the box.