CVE-2025-40892
HIGHCVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1Description
A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.
Analysis
Stored cross-site scripting in Nozomi Networks CMC and Guardian allows authenticated users with report privileges to inject malicious JavaScript payloads into report definitions. When victims view or import these weaponized reports, the XSS executes in their browser context, enabling attackers to modify application data, disrupt availability, and access sensitive information. The vulnerability requires low-privilege authentication and user interaction (CVSS:4.0 score 7.1, PR:L/UI:P), with high integrity and availability impacts but limited confidentiality exposure. No public exploit identified at time of analysis, though the attack technique is well-understood and straightforward given the stored XSS nature.
Technical Context
This is a stored (persistent) cross-site scripting vulnerability (CWE-79) affecting the Reports functionality in Nozomi Networks CMC (Central Management Console) and Guardian products. The vulnerability stems from insufficient input validation when processing report definition parameters. Unlike reflected XSS, stored XSS persists the malicious payload in the application's data store (report definitions or templates), making it more dangerous as it affects all users who subsequently interact with the poisoned data. The attack surface includes both direct creation of malicious reports by authenticated users and social engineering vectors where victims import externally-crafted report templates. The CVSS 4.0 vector indicates network-accessible exploitation (AV:N) with low attack complexity (AC:L) but requires low-level authentication (PR:L) and victim interaction (UI:P). The vulnerability affects both confidentiality and integrity across security boundaries (VC:L/VI:H, SC:L/SI:L), suggesting the XSS can impact other users' sessions beyond the immediate victim.
Affected Products
The vulnerability affects Nozomi Networks CMC (Central Management Console) and Guardian products, as identified by CPE strings cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:* and cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*. Specific vulnerable version ranges are not detailed in the provided CVE data, but the vendor security advisory at https://security.nozominetworks.com/NN-2025:13-01 should contain precise affected versions. Additionally, Siemens has issued a related advisory at https://cert-portal.siemens.com/productcert/html/ssa-827968.html, suggesting potential impact on Siemens products that integrate or bundle Nozomi Networks components. Users of both Nozomi-branded products and Siemens OT security solutions incorporating these components should consult both advisories for complete affected product identification.
Remediation
Consult the official Nozomi Networks security advisory NN-2025:13-01 at https://security.nozominetworks.com/NN-2025:13-01 for specific patched versions and upgrade instructions for CMC and Guardian products. Organizations should upgrade to the vendor-recommended fixed versions as the primary remediation strategy. As an interim mitigation, restrict report creation and import privileges to a minimal set of trusted administrators, implement strict review processes for any externally-sourced report templates before importing, and educate users about the risks of importing untrusted report definitions. Additionally, review Siemens security advisory SSA-827968 at https://cert-portal.siemens.com/productcert/html/ssa-827968.html if using Siemens-branded products that incorporate Nozomi components. Deploy Content Security Policy (CSP) headers if feasible to provide defense-in-depth against XSS execution, though this should not replace patching.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today