Nozomi Guardian EUVD-2025-209893

Exploitation requires the attacker to hold an authenticated session with administrative privileges on Guardian or CMC - PR:H in the CVSS vector confirms this is not an unauthenticated or low-privilege attack path. The injected payload only executes when a second user (the victim) performs the specific action of attempting to delete a group that contains the malicious user account; the victim must be using a browser session on the affected platform (UI:P). The application's Content Security Policy prevents the injected content from executing scripts or accessing sensitive DOM data, limiting the impact to HTML rendering, open redirects, and phishing - direct XSS code execution and information disclosure are not achievable under normal deployment. Non-default or weakened CSP configurations could expand the attack surface beyond what the vendor describes.

The CVSS 4.0 score of 4.8 (Medium) is grounded in a vector of AV:N/AC:L/AT:N/PR:H/UI:P, which accurately reflects the attack's significant prerequisites: the attacker must hold high-privilege (administrative) credentials, and exploitation requires a separate victim user to perform a specific action (deleting a group). These factors combine to produce a genuinely constrained threat profile. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be assessed. The CVE is not listed in CISA KEV, and no publicly available proof-of-concept code has been identified at time of analysis. The partial-integrity and partial-confidentiality impact ratings (VI:L, VC:L) align with the vendor's own assessment that CSP prevents full XSS and direct data exfiltration. The realistic threat here is an insider threat scenario: a rogue admin plants a malicious username as a persistence mechanism or social engineering vector targeting other administrators. For organizations with strict administrative access controls and audit logging, this is a low-urgency but patchable issue; for environments with shared or weakly governed admin accounts, the risk is proportionally higher.

A rogue or compromised administrator authenticates to the Guardian or CMC management console and creates a new user account with a username containing an HTML anchor tag pointing to an attacker-controlled domain, for example as an open redirect payload. When a separate administrator later navigates to delete a group that contains this user, the injected HTML renders in their browser - presenting a convincing phishing link or silently redirecting them to a credential-harvesting page. No proof-of-concept code has been publicly identified, but the technique is a well-understood variant of stored HTML injection requiring no advanced tooling.