Nozomi Guardian CVE-2025-40903

Exploitation requires an authenticated session with high (administrative) privileges on Nozomi Networks Guardian or CMC, as confirmed by PR:H in the CVSS 4.0 vector - an attacker must have already obtained administrative credentials before injecting content. A second condition is victim interaction: a separate user must navigate to and view the affected Schedule Restore Archive entry in their browser (UI:P per CVSS). The injection point is specifically the Schedule Restore Archive input parameter; other configuration areas are not implicated by this CVE. Full XSS execution is not achievable due to active Content Security Policy enforcement and server-side input validation, as explicitly confirmed in the CVE description - attack outcomes are limited to HTML rendering effects such as phishing anchors and open redirects. Non-administrative users cannot trigger the injection phase, and users who never view the affected schedule entry are not exposed.

The CVSS 4.0 score of 4.8 (Medium) accurately reflects a meaningfully constrained attack profile: while the attack vector is network-accessible (AV:N) with no additional complexity (AC:L), exploitation demands high privileges (PR:H - administrative account) and passive victim interaction (UI:P - a user must view the schedule). These two prerequisites together substantially reduce real-world risk. No EPSS score was provided in the source data, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept has been identified, indicating no confirmed active or widespread exploitation at time of analysis. Impact scores across all dimensions are rated Low (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L), consistent with the description's confirmation that direct information disclosure and full XSS are prevented by existing controls. For most enterprise environments this represents a low-urgency patching candidate; however, in OT/ICS contexts, administrative account compromise followed by operator-targeted phishing carries disproportionate risk given the sensitivity of the underlying systems being managed.

An attacker who has obtained valid administrative credentials for a Nozomi Networks Guardian or CMC instance navigates to the Schedule Restore Archive feature and creates or modifies a restore schedule, embedding HTML such as a hidden anchor tag pointing to a credential-harvesting site or a meta refresh open redirect into the vulnerable input parameter. When a network operator or security analyst subsequently opens the schedule view in their browser, the injected HTML renders, potentially presenting a convincing phishing link disguised within the legitimate management interface. No public proof-of-concept is known; full JavaScript execution via this vector is prevented by the platform's Content Security Policy.