CVE-2025-40892
Stored XSS in Reports Allows Data Manipulation and Disclosure
Publication date: 2025-12-18
Last updated on: 2026-04-14
Assigner: Nozomi Networks Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nozominetworks | cmc | * |
| nozominetworks | guardian | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2025-40892 is a Stored Cross-Site Scripting (XSS) vulnerability in the Reports functionality of Nozomi Networks Guardian and CMC products. It occurs because of improper validation of an input parameter. An authenticated user with report privileges can create a malicious report containing JavaScript code, or a victim can be tricked into importing a malicious report template. When the victim views or imports this report, the malicious script runs in their browser, allowing the attacker to perform unauthorized actions. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute unauthorized actions as the victim, such as modifying application data, disrupting application availability, and accessing sensitive information that should be limited. This can lead to data integrity issues, service disruption, and potential data breaches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves auditing report templates for malicious JavaScript payloads and monitoring user activities related to report creation or import. Since the vulnerability is a Stored Cross-Site Scripting in report templates, you can search for suspicious script tags or JavaScript code within report definitions. Commands to search for suspicious content might include using grep or similar tools on report template files or database entries, for example: grep -i '<script' /path/to/report/templates or querying the database for suspicious patterns. Additionally, monitoring web management interface access logs for unusual activity by users with report privileges can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the web management interface using internal firewall rules, auditing and removing unnecessary user accounts with report privileges, and reviewing existing report templates to identify and remove any malicious or suspicious content. The definitive solution is to upgrade the affected products (Guardian and CMC) to version 25.5.0 or later. [1]