Open Redirect CVE-2025-40893

Real-world risk is moderate despite medium CVSS (5.3). The exploit requires three preconditions: attacker network position to send crafted packets to the monitored infrastructure, victim user interaction to view the Asset List, and successful HTML injection past input filters (already partially constrained by CSP). EPSS exploitation probability is not provided in input data. Critically, this is NOT a high-risk vulnerability because the CVSS vector explicitly shows VC:N (no confidentiality impact from attacker perspective), VI:L (victim confidentiality slightly impacted), and VA:N (no availability impact), combined with UI:P (user interaction required). The primary threat is social engineering via injected HTML (phishing links, open redirects) rather than arbitrary code execution or privilege escalation. No KEV status or public POC is indicated. The attack surface is limited to organizations running Nozomi CMC or Guardian and exposing the Asset List to potentially hostile network segments. For defenders, this is a medium-priority patch candidate that should be prioritized for externally-facing instances but is lower urgency for internal-only deployments.

An attacker on the same network segment as a Nozomi CMC or Guardian deployment sends specially crafted packets containing HTML payloads (e.g., <iframe src='https://attacker-phishing-site.com'></iframe>) that are parsed and stored in asset attribute fields. When a security operator views the Asset List in the web console, the injected HTML renders in their browser, potentially redirecting them to a fake login page or executing a client-side attack. Because user interaction (viewing the Asset List) is required and CSP partially mitigates full XSS, the attack vector is most effective for targeted phishing against known staff.