Nozomi Guardian EUVD-2025-209895

Exploitation requires an authenticated account with at minimum low-privilege access (PR:L per CVSS 4.0 vector) on the target Guardian or CMC instance - unauthenticated exploitation is not possible. The attacker must have sufficient permissions to create or modify remote strategies and trigger the Smart Polling sync mechanism; this is a non-default operational role, not a guest or read-only account. A victim user must actively view the maliciously crafted remote strategy within the Smart Polling UI (UI:P - passive interaction, meaning the victim navigates to the content in normal workflow, not that they click a link). Full XSS execution is prevented by the product's Content Security Policy, limiting attacker impact to HTML rendering effects (open redirect, phishing overlays). Exploitation is further limited to versions of Guardian and CMC prior to 26.1.0.

CVSS 4.0 scores this at 5.1 (Medium), with a vector of AV:N/AC:L/AT:N/PR:L/UI:P. The network-accessible attack vector and low complexity increase reach, but PR:L (low privileges required) and UI:P (passive user interaction - victim must view the strategy) meaningfully constrain exploitability. The vendor's own description confirms full XSS and direct information disclosure are prevented by CSP, further reducing the ceiling of impact. EPSS data was not provided in the input, preventing probability-of-exploitation comparison. No KEV listing and no POC availability signal this is not currently under active or widespread exploitation. For organizations running Nozomi in SOC or OT monitoring contexts, the realistic risk is targeted phishing against analysts who regularly review Smart Polling strategies - a plausible but narrower threat than a generic web XSS. The limited impact scope (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L across CVSS 4.0 environmental metrics) corroborates this medium-severity classification. No conflicting signals between data sources were identified.

An attacker holding a low-privilege account on a Nozomi Guardian or CMC deployment crafts a remote strategy embedding HTML such as a hidden redirect anchor or spoofed login form, then pushes it through the Smart Polling sync mechanism. A higher-privileged analyst or administrator later opens that strategy in the Smart Polling UI, at which point the injected HTML renders in their browser - potentially redirecting them to an attacker-controlled phishing page mimicking the Nozomi login interface to harvest credentials. No public POC has been identified, and full JavaScript execution is blocked by CSP, so the scenario requires social engineering rather than automated script-based exploitation.