CVE-2025-40893
Stored HTML Injection in Asset List Enables Phishing Attacks
Publication date: 2025-12-18
Last updated on: 2026-04-14
Assigner: Nozomi Networks Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nozominetworks | cmc | * |
| nozominetworks | guardian | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-40893 is a Stored HTML Injection vulnerability in the Asset List functionality of Nozomi Networks Guardian and CMC products before version 25.5.0. It occurs because network traffic data is not properly validated, allowing an unauthenticated attacker to send specially crafted packets that inject malicious HTML tags into asset attributes. When users view these assets, the injected HTML is rendered in their browsers, which can lead to phishing attacks and open redirect scenarios. However, full cross-site scripting exploitation and direct information disclosure are prevented by existing input validation and Content Security Policy. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by enabling attackers to inject malicious HTML into asset attributes that are viewed in the Asset List or similar interfaces. This can lead to phishing attacks where users might be tricked into revealing sensitive information, or open redirect attacks that redirect users to malicious sites. Although full cross-site scripting and direct data leaks are mitigated, the risk of social engineering and redirection attacks remains. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the affected Guardian and CMC products to version 25.5.0 or later, as this version resolves the issue. No other workarounds or mitigations are provided. [1]