Cmc CVE-2025-40892

The real-world risk is moderate despite the 7.1 CVSS score. The vulnerability requires authenticated access with report privileges (PR:L), limiting the initial attack surface to insiders or compromised accounts, and mandates user interaction (UI:P) for exploitation. However, the high integrity and availability impacts (VI:H/VA:H) combined with cross-scope effects (SC:L/SI:L/SA:L) indicate serious consequences when successfully exploited, particularly in OT/ICS environments where Nozomi products are deployed for network monitoring. The stored nature makes this more persistent and dangerous than reflected XSS. No EPSS score provided, but absence of KEV status and public exploit code suggests this is not currently being actively exploited in the wild. The social engineering vector (importing malicious report templates) is realistic in enterprise environments where analysts share custom reports. SSVC considerations: exploitation requires authentication and social engineering (not fully automatable), technical impact is significant (session hijacking, data manipulation), but the attack complexity and prerequisite conditions lower immediate urgency compared to unauthenticated remote code execution vulnerabilities. Organizations using Nozomi CMC/Guardian in critical infrastructure should prioritize remediation due to the operational context, even though exploitation probability appears currently low.

An attacker with low-privilege authenticated access to Nozomi CMC creates a custom report definition containing a malicious JavaScript payload in a report parameter field that lacks proper input validation. The attacker shares this report with administrators or uses social engineering to convince a privileged user to import the weaponized report template. When the victim views the report in their browser, the stored XSS payload executes with the victim's session privileges, allowing the attacker to steal session tokens, modify critical OT network monitoring configurations, manipulate alert definitions to hide malicious activity, or exfiltrate limited sensitive data about the monitored industrial network.