Executive Summary

CVE-2025-40891 is a Stored HTML Injection vulnerability in the Time Machine Snapshot Diff feature of Nozomi Networks Guardian and CMC products before version 25.5.0. It occurs because network traffic data is not properly validated, allowing an unauthenticated attacker to send specially crafted packets at two different times to inject malicious HTML tags into asset attributes across two snapshots. When a victim uses the Snapshot Diff feature on those snapshots and performs specific GUI actions, the injected HTML renders in their browser, enabling phishing and open redirect attacks. Full cross-site scripting is prevented by input validation and Content Security Policy, and the attack is complex due to multiple required conditions. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by enabling attackers to perform phishing and open redirect attacks through the injected HTML rendered in your browser when using the Time Machine Snapshot Diff feature. Although full cross-site scripting is mitigated, the injected content can still deceive users or redirect them to malicious sites, potentially compromising user trust and security. Exploitation requires specific user actions and conditions, making the attack complex but still possible. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The only mitigation available is to upgrade Guardian and CMC products to version 25.5.0 or later, as there are no workarounds or other mitigations available. [1]

Useful 0 Not Useful 0