EUVD-2025-209471
GHSA-28p4-5j5m-924h
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionNVD
A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victim views the Assets or Nodes pages, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.
AnalysisAI
Stored Cross-Site Scripting (XSS) in Nozomi Networks Guardian and CMC allows authenticated attackers with custom field privileges to inject malicious JavaScript payloads through the Assets and Nodes custom field functionality. When victims view affected pages, the XSS executes with high integrity and availability impact due to changed scope (CVSS S:C), enabling unauthorized actions including data modification and service disruption. No public exploit identified at time of analysis, though the attack complexity is low (AC:L) once custom field access is obtained.
Technical ContextAI
This vulnerability affects Nozomi Networks Guardian and Central Management Console (CMC), industrial control system (ICS) and operational technology (OT) network monitoring platforms. The flaw stems from improper input validation (CWE-79: Improper Neutralization of Input During Web Page Generation) in the custom fields feature within Assets and Nodes pages. The stored XSS nature means the malicious payload persists in the application database and executes whenever users navigate to the compromised pages, rather than requiring repeated injection. The changed scope indicator (S:C) in the CVSS vector signifies the vulnerability can affect resources beyond its original security context, allowing attackers to perform actions in victims' authenticated sessions with potentially elevated privileges compared to their own low-privilege custom field access.
RemediationAI
Organizations running affected Nozomi Networks Guardian or CMC instances should immediately review the vendor security advisory at https://security.nozominetworks.com/NN-2026:2-01 for patch availability and specific remediation guidance. Until patches can be applied, implement compensating controls including restricting custom field creation privileges to only essential trusted administrators, implementing enhanced session monitoring for users with custom field access, deploying Content Security Policy (CSP) headers if supported to limit inline script execution, and conducting security awareness training for users who regularly access Assets and Nodes pages to recognize suspicious behaviors. Review existing custom fields for potentially malicious JavaScript content and audit user accounts with custom field privileges for unauthorized access or privilege escalation.
Share
External POC / Exploit Code
Leaving vuln.today