Open Redirect CVE-2025-40891

Despite the low CVSS score of 2.3, this vulnerability exhibits several mitigating factors that justify its modest rating: CVSS 4.0 vector shows unauthenticated remote access (AV:N, PR:N) but high attack complexity (AC:H), user interaction requirement (UI:P), and low integrity impact (VI:L) with limited scope (SC:L). The vulnerability requires an attacker to perform precise timing of network packet injection, victim interaction with a specific feature, and specific GUI actions before any payload renders. Content Security Policy actively blocks full XSS payloads, and remaining input validation prevents script execution-meaning the threat is primarily limited to HTML-based phishing and open redirect attacks rather than arbitrary code execution. EPSS data is not provided, but exploitation is realistic only under contrived conditions. No KEV confirmation or public exploit code is documented, further reducing real-world exploitation likelihood. This is a genuine but operationally constrained vulnerability more aligned with a medium-risk phishing vector than a critical attack pathway.

An attacker crafts specially formatted network packets targeting a monitored asset at two different time intervals, injecting HTML tags (e.g., crafted anchor tags with javascript: URIs or external redirects) into asset attribute fields. When a network administrator uses the Time Machine Snapshot Diff feature to compare the two snapshots and hovers over or clicks on the injected attribute, the HTML renders in their browser. Due to CSP restrictions, the injected script does not execute, but the HTML link directs the administrator to a phishing site or attacker-controlled domain, potentially compromising credentials.