CVE-2025-40885: Nozomi Networks CMC SQLi Vulnerability

CVE-2025-40885 Overview

CVE-2025-40885 is a SQL Injection vulnerability [CWE-89] affecting the Smart Polling functionality in Nozomi Networks CMC and Guardian products. The flaw stems from improper validation of an input parameter passed to the web application backend. An authenticated attacker with limited privileges can inject arbitrary SELECT statements against the underlying database management system (DBMS). Successful exploitation exposes unauthorized data stored by the appliance, including configuration details and operational telemetry collected from monitored industrial networks.

Critical Impact
Authenticated low-privilege users can execute arbitrary SELECT SQL statements against the appliance DBMS, leading to disclosure of data the user is not authorized to view.

Affected Products

Nozomi Networks CMC (Central Management Console)
Nozomi Networks Guardian
Refer to vendor advisory NN-2025:6-01 for fixed version details

Discovery Timeline

2025-10-07 - CVE-2025-40885 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40885

Vulnerability Analysis

The vulnerability resides in the Smart Polling feature of Nozomi Networks CMC and Guardian. Smart Polling actively queries industrial assets to collect additional telemetry beyond passive network monitoring. The web application accepts an input parameter that is incorporated into a backend SQL query without proper validation or parameterization. An authenticated user with limited role privileges can modify this parameter to append or alter the executed query. The vulnerability is constrained to SELECT statements, meaning the attacker cannot directly modify or delete records through this entry point. However, read access to the DBMS can expose configuration data, device inventories, polling credentials, and historical telemetry collected from operational technology (OT) environments.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The affected parameter in the Smart Polling handler is concatenated into a SQL query without the use of prepared statements or strict input validation. The attack requires authentication, so only accounts with existing access to the web interface can leverage the flaw.

Attack Vector

The attack vector is network-based and requires valid credentials with low privileges. An attacker submits a crafted HTTP request to the Smart Polling endpoint containing SQL metacharacters in the vulnerable parameter. The backend processes the injected payload as part of the resulting query. Because the attack complexity is high, the attacker must satisfy additional conditions related to the query structure before extracting data reliably through techniques such as UNION-based or boolean-based inference. No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is available. Refer to the Nozomi Networks Security Advisory NN-2025:6-01 for vendor-provided technical details.

Detection Methods for CVE-2025-40885

Indicators of Compromise

HTTP requests to Smart Polling endpoints containing SQL metacharacters such as ', UNION, SELECT, --, or /* in parameter values
Unusual query patterns or elevated query counts originating from low-privilege web application accounts
Web application log entries showing database errors tied to malformed Smart Polling parameters

Detection Strategies

Inspect web application and reverse proxy logs for anomalous parameter values submitted to Smart Polling URLs
Deploy web application firewall (WAF) signatures targeting common SQL injection payloads on the CMC and Guardian management interfaces
Correlate authentication events with subsequent Smart Polling requests to identify low-privilege accounts probing the endpoint

Monitoring Recommendations

Enable verbose auditing on the Nozomi web application and forward logs to a central SIEM for retention and correlation
Monitor DBMS query logs for unexpected SELECT statements referencing sensitive tables such as credential or configuration stores
Alert on repeated HTTP 500 responses from Smart Polling endpoints, which may indicate injection probing

How to Mitigate CVE-2025-40885

Immediate Actions Required

Apply the fixed versions of CMC and Guardian as specified in Nozomi Networks Security Advisory NN-2025:6-01
Review and reduce the number of accounts with access to the Smart Polling functionality
Rotate credentials for any low-privilege accounts that may have been exposed

Patch Information

Nozomi Networks has published vendor advisory NN-2025:6-01 with fixed releases for CMC and Guardian. Administrators should consult the Nozomi Networks Security Advisory for the specific fixed version numbers that correspond to their deployment.

Workarounds

Restrict network access to the CMC and Guardian web management interfaces to trusted administrative networks only
Enforce multi-factor authentication and strong password policies to limit abuse of authenticated endpoints
Place the management interface behind a WAF configured to block SQL injection patterns targeting Smart Polling parameters

bash

# Example network restriction using iptables to limit management interface access
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP