Vulnetix
Try Vulnetix Request Demo
CVE-2025-40893 PUBLISHED CVSS 5.300000190734863 MEDIUM

A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network packets to inject HTML tags into asset attributes. When a victim views the affected assets in the Asset List (and similar functions), the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.

EPSS 0.05% · 17.0th percentile

Risk Scores

CVSS v4.0
5.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS Score
0.05%
17.0th percentile

Affected Products

VendorProductVersions
Nozomi NetworksGuardian0
nozomi_networksguardian0
nozominetworksguardian0
nozomi_networkscmc0
nozominetworkscmc0
Nozomi NetworksCMC0

Timeline

References

Open in Interactive Console →