Cmc EUVD-2025-209471

This CVE presents elevated real-world risk despite requiring authentication (PR:L) and user interaction (UI:R). The CVSS score of 8.9 reflects high integrity and availability impact with changed scope, indicating potential for significant operational disruption in industrial environments where Guardian and CMC are deployed. The attack complexity is low (AC:L), meaning exploitation is straightforward once an attacker obtains custom field privileges. No EPSS score is provided in the available data, and confirmed actively exploited status is absent (no KEV listing). The SSVC framework considerations suggest moderate priority: while not automatable due to UI requirement and authentication prerequisite, the technical impact on ICS/OT monitoring systems could be severe if attackers leverage this to mask malicious activity or disrupt visibility into critical infrastructure. The stored nature and changed scope elevate this above typical authenticated XSS vulnerabilities, particularly in high-security OT environments where session hijacking could enable lateral movement or reconnaissance masking.

An attacker who has compromised a low-privilege account with custom field creation rights in Nozomi Networks Guardian creates a malicious custom field named 'Equipment_Status' containing obfuscated JavaScript designed to exfiltrate session tokens and modify asset criticality ratings. When a security operations center analyst reviews the Assets page during routine monitoring, the stored XSS executes in their browser context with their elevated privileges, silently sending their authentication cookies to an attacker-controlled server while downgrading the criticality classification of compromised industrial assets to evade detection thresholds.