CVE-2025-40894

LOW EPSS 5.8%

Published Mar 4, 20263mo ago · Modified Jun 17, 20261w ago

2.1 CVSS 4.0

Low

Published Mar 4, 2026 3mo ago

Last Modified Jun 17, 2026 1w ago

Description

A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parameter. A malicious authenticated user with the required privileges could edit a node label to inject HTML tags. If the system is configured to use the Alerted Nodes Dashboard, and alerts are reported for the affected node, then the injected HTML may render in the browser of a victim user interacting with it, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.

CVSS Details

Base Score

2.1

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity High

Privileges Required Low

User Interaction P

Scope X

Threat Intelligence

EPSS Exploit Probability

5.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 2

Vendor	Product	Version	Range
nozominetworks	cmc	*	<25.6.0
nozominetworks	guardian	*	<25.6.0

References 2

cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-827968.html
security.nozominetworks.com https://security.nozominetworks.com/NN-2025:16-01

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.