Cmc
CVE-2025-40892
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.
AnalysisAI
Stored cross-site scripting in Nozomi Networks CMC and Guardian allows authenticated users with report privileges to inject malicious JavaScript payloads into report definitions. When victims view or import these weaponized reports, the XSS executes in their browser context, enabling attackers to modify application data, disrupt availability, and access sensitive information. The vulnerability requires low-privilege authentication and user interaction (CVSS:4.0 score 7.1, PR:L/UI:P), with high integrity and availability impacts but limited confidentiality exposure. No public exploit identified at time of analysis, though the attack technique is well-understood and straightforward given the stored XSS nature.
Technical ContextAI
This is a stored (persistent) cross-site scripting vulnerability (CWE-79) affecting the Reports functionality in Nozomi Networks CMC (Central Management Console) and Guardian products. The vulnerability stems from insufficient input validation when processing report definition parameters. Unlike reflected XSS, stored XSS persists the malicious payload in the application's data store (report definitions or templates), making it more dangerous as it affects all users who subsequently interact with the poisoned data. The attack surface includes both direct creation of malicious reports by authenticated users and social engineering vectors where victims import externally-crafted report templates. The CVSS 4.0 vector indicates network-accessible exploitation (AV:N) with low attack complexity (AC:L) but requires low-level authentication (PR:L) and victim interaction (UI:P). The vulnerability affects both confidentiality and integrity across security boundaries (VC:L/VI:H, SC:L/SI:L), suggesting the XSS can impact other users' sessions beyond the immediate victim.
RemediationAI
Consult the official Nozomi Networks security advisory NN-2025:13-01 at https://security.nozominetworks.com/NN-2025:13-01 for specific patched versions and upgrade instructions for CMC and Guardian products. Organizations should upgrade to the vendor-recommended fixed versions as the primary remediation strategy. As an interim mitigation, restrict report creation and import privileges to a minimal set of trusted administrators, implement strict review processes for any externally-sourced report templates before importing, and educate users about the risks of importing untrusted report definitions. Additionally, review Siemens security advisory SSA-827968 at https://cert-portal.siemens.com/productcert/html/ssa-827968.html if using Siemens-branded products that incorporate Nozomi components. Deploy Content Security Policy (CSP) headers if feasible to provide defense-in-depth against XSS execution, though this should not replace patching.
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
Disk-exhaustion denial of service in Nozomi Networks Guardian and Central Management Console (CMC) lets a remote, unauth
A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in ce
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting
Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticat
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an auth
A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain
An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript cod
Privilege escalation via configuration synchronization in Nozomi Networks Guardian and Central Management Console (CMC)
Privilege escalation in Nozomi Networks Guardian and CMC Threat Intelligence module allows authenticated view-only users
Path traversal in Nozomi Networks CMC and Guardian allows authenticated users with limited privileges to write arbitrary
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today