Nozomi Guardian EUVD-2025-209892

Exploitation requires the attacker to hold an authenticated account on the Guardian or CMC platform with report creation or import privileges (PR:L per CVSS). The vulnerability is exclusively in the Reports functionality - deployments where no users hold report privileges are not directly exploitable via the self-service path. The social engineering path additionally requires a victim with sufficient privileges to view or import the crafted report to take that action (UI:P). Exploitation is limited in impact by the platform's existing Content Security Policy and input validation, which prevent full XSS payload execution and direct information disclosure - the confirmed impact is limited to application data modification and availability disruption within the application context. No special network conditions or non-default protocol configurations are required beyond authenticated access over the network.

The CVSS 4.0 base score of 5.1 (Medium) reflects a constrained but realistic attack surface. The vector AV:N/AC:L/AT:N/PR:L/UI:P indicates network reachability with low complexity, but mandates both authenticated access (PR:L) and passive victim interaction (UI:P), materially reducing the likelihood of opportunistic mass exploitation. Impact metrics VC:N/VI:L/VA:L confirm that confidentiality is not directly compromised, and integrity and availability impacts are limited - consistent with the description's note that CSP prevents full XSS and direct information disclosure. No KEV listing and no known public exploit code further reduce real-world urgency compared to unauthenticated or higher-impact vulnerabilities. EPSS data was not provided in the source intelligence; given the authentication requirement and specialized industrial product scope, widespread automated exploitation is unlikely. The primary risk vector is insider threat or targeted social engineering against OT security personnel who routinely share report templates. Despite the moderate CVSS score, the deployment context - OT/ICS monitoring platforms - warrants prompt patching given the operational sensitivity of the environments these products monitor.

An attacker with a low-privileged account on Nozomi Guardian or CMC that holds report creation rights crafts a report definition embedding a malicious Angular template expression - for example, injecting template syntax that triggers DOM manipulation or application state changes when rendered. The attacker either executes the report themselves (if their own privileges suffice to view the rendered output) or exports and distributes the malicious report template file to a higher-privileged colleague via email or internal sharing, exploiting the trust users place in report templates from known colleagues. When the victim imports and views the report in their browser, the Angular template payload executes in their session, allowing the attacker to alter application configuration data or degrade availability of the monitoring interface. No public proof-of-concept exploit code has been identified at time of analysis.