Nozomi Guardian/CMC CVE-2025-40888

Exploitation requires an attacker to already possess an authenticated account with limited privileges on the appliance and access to the CLI functionality, where an input parameter is improperly validated (PR:L). Impact is limited to reading data via arbitrary SELECT statements - no write, modification, or availability impact is possible (VI:N/VA:N). Realistic risk is further constrained by high attack complexity (AC:H) and a present attack requirement (AT:P), meaning the attacker must satisfy conditions beyond their control for the injection to succeed; the vulnerability affects only Nozomi Networks Guardian and CMC products.

This is a medium-severity, lower-priority issue rather than an urgent threat. The CVSS 4.0 base score of 6.0 reflects a vulnerability that is network-reachable (AV:N) but gated by high attack complexity (AC:H), a present attack requirement (AT:P), and low-privilege authentication (PR:L); impact is confined to confidentiality (VC:H) with no integrity or availability effect, consistent with a SELECT-only SQL injection that reads but does not modify data. All exploitation signals point the same direction: EPSS is low at 0.24% (14th percentile), there is no CISA KEV listing, and no public exploit code has been identified, so no active-exploitation or weaponization signal exists. The signals are internally consistent - there is no CVSS-versus-EPSS or KEV conflict to reconcile. The primary caveat is that the only base score provided is a CVSS 4.0 vector (no CVSS 3.1 vector or NVD-assigned score is present), and the affected products are specialized OT/ICS monitoring appliances, which constrains both the attacker population (must already be an authenticated, limited-privilege user) and the overall footprint. Net: a legitimate finding worth patching in affected Nozomi deployments, but not a drop-everything priority.

An attacker who already holds a low-privilege authenticated account on a Nozomi Networks Guardian or CMC appliance abuses an improperly validated input parameter in the CLI to inject arbitrary SELECT statements. By doing so they read database contents they are not authorized to see - potentially other users' data or monitoring records - escalating their effective data access without modifying anything. No public exploit code has been identified at time of analysis, and the high complexity plus attack requirement mean exploitation is non-trivial.