Nozomi Networks Guardian CVE-2025-40901

Exploitation requires the attacker to hold authenticated access with administrative privileges on the Nozomi Networks Guardian or CMC instance (confirmed by CVSS PR:H). A second user must then trigger the delete action on the malicious identity entry in Credentials Manager - this passive user interaction (CVSS UI:P) cannot be bypassed; the injection does not fire on page load or browsing, only on the specific deletion workflow. Full XSS (script execution) is explicitly prevented by the platform's Content Security Policy, confirmed by the vendor description; achievable impact is limited to rendered HTML, phishing content, and open redirect. The vulnerability does not affect default-out-of-the-box deployments where no additional admin accounts exist, and is not exploitable without first compromising or acting as an administrative account.

The CVSS 4.0 base score of 4.8 (Medium) aligns well with the realistic threat model. The CVSS vector AV:N/AC:L/AT:N/PR:H/UI:P encodes three important limiting factors: the attacker must already hold high-privileged (administrative) access (PR:H), a victim must perform a specific interaction - attempting to delete the injected identity - (UI:P), and the achievable confidentiality/integrity/availability impacts are all rated Low. No EPSS data was supplied in the available intelligence, so exploitation probability cannot be quantified numerically. The vulnerability is not in CISA KEV, and no public proof-of-concept has been identified, indicating no confirmed or widespread active exploitation at time of analysis. The threat is most credible in multi-administrator environments or post-initial-compromise scenarios where an attacker has already obtained admin credentials and wants to pivot to phishing other privileged users. The CSP-enforced ceiling on impact (no script execution, no direct data exfiltration) is a meaningful and vendor-confirmed mitigating control. Overall, this is a low-to-medium operational priority: important to patch given the OT/ICS context where admin credential compromise and insider threat scenarios are realistic, but not an emergency compared to unauthenticated or pre-auth vulnerabilities in the same product family.

An attacker who has obtained administrator credentials to a Guardian or CMC instance navigates to the Credentials Manager and creates or edits an identity, embedding an HTML anchor tag pointing to an attacker-controlled phishing page in the identity name field. When a victim administrator or operator later attempts to delete that identity through the normal UI workflow, the injected HTML renders in their browser, presenting a convincing fake login prompt or silently redirecting them to a malicious site to harvest credentials. No public proof-of-concept code has been identified, but the attack requires only basic HTML knowledge and authenticated admin access.