CVE-2025-40895: Nozomi Networks CMC Stored XSS Vulnerability

CVE-2025-40895 Overview

A Stored HTML Injection vulnerability has been identified in the Nozomi Networks CMC (Central Management Console) Sensor Map functionality. The vulnerability stems from improper validation of connected Guardians' properties, allowing malicious content to be injected and persistently stored within the application.

A malicious authenticated user with administrator privileges on a Guardian connected to a CMC can edit the Guardian's properties to inject HTML tags. When the Sensor Map functionality is enabled in the CMC and a victim CMC user interacts with it, the injected HTML may render in their browser. This enables phishing attacks and potentially open redirect scenarios. However, full XSS exploitation and direct information disclosure are mitigated by existing input validation controls and Content Security Policy (CSP) configuration.

Critical Impact

Authenticated administrators on connected Guardian devices can inject malicious HTML content that renders in victim browsers, enabling phishing and potential open redirect attacks against CMC users.

Affected Products

• Nozomi Networks CMC (Central Management Console)
• Nozomi Networks Guardian (as attack vector)

Discovery Timeline

• 2026-03-04 - CVE CVE-2025-40895 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2025-40895

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in the Sensor Map functionality of the CMC platform, where Guardian device properties are displayed without adequate sanitization.

The attack requires an authenticated user with administrator privileges on a Guardian device that is connected to the CMC. By modifying the Guardian's properties with malicious HTML content, an attacker can inject persistent code that executes when other CMC users view the Sensor Map. The network-based attack vector combined with the requirement for high privileges and user interaction limits the overall exploitability.

While the existing Content Security Policy (CSP) configuration prevents full XSS exploitation and direct information disclosure, the vulnerability still poses risks through phishing attacks and potential open redirect scenarios that could be leveraged in social engineering campaigns.

Root Cause

The root cause is improper input validation on Guardian device properties that are displayed in the CMC Sensor Map. When administrators configure Guardian properties, the CMC fails to adequately sanitize or encode HTML special characters before rendering them in the Sensor Map interface. This allows HTML markup to be stored and subsequently executed in the context of other users' browser sessions.

Attack Vector

The attack leverages the network-accessible CMC interface and requires an attacker to have administrator privileges on a Guardian device connected to the CMC. The attack flow involves:

1. An attacker with Guardian administrator access modifies device properties to include malicious HTML tags
2. The malicious content is stored in the CMC database
3. When another CMC user accesses the Sensor Map functionality, the injected HTML renders in their browser
4. The victim may be subjected to phishing attempts or redirected to malicious external sites

The vulnerability requires user interaction (viewing the Sensor Map) and passive attacker positioning, making it a stored/persistent injection rather than a reflected attack. The existing input validation and CSP implementation prevent escalation to full XSS but do not completely block HTML injection.

Detection Methods for CVE-2025-40895

Indicators of Compromise

• Unusual HTML tags or encoded characters in Guardian property fields within the CMC database
• Unexpected iframe, anchor, or form elements appearing in Sensor Map displays
• User reports of suspicious redirects or phishing prompts when accessing the Sensor Map

Detection Strategies

• Implement audit logging for all Guardian property modifications, particularly those containing special characters or HTML markup
• Monitor CMC access logs for unusual patterns following Guardian configuration changes
• Deploy web application firewall (WAF) rules to detect HTML injection patterns in property update requests

Monitoring Recommendations

• Enable verbose logging on CMC administrative actions related to Guardian device management
• Configure alerts for property changes containing common HTML injection patterns such as <script>, <iframe>, <a href>, or encoded variants
• Regularly audit Guardian property values for unexpected content or formatting anomalies

How to Mitigate CVE-2025-40895

Immediate Actions Required

• Review and restrict administrator access to Guardian devices connected to CMC instances
• Audit existing Guardian property configurations for any signs of injected HTML content
• Consider temporarily disabling the Sensor Map functionality until patches are applied
• Educate CMC users about potential phishing attempts when interacting with the Sensor Map

Patch Information

Nozomi Networks has released a security advisory addressing this vulnerability. Administrators should review the Nozomi Networks Security Advisory for detailed patch information and apply updates according to the vendor's guidance.

Organizations should prioritize applying the official security patch to all affected CMC installations. Ensure that Guardian devices are also updated if vendor guidance indicates related fixes are required.

Workarounds

• Implement strict access controls limiting Guardian administrator privileges to trusted personnel only
• Disable the Sensor Map functionality in CMC if not operationally required
• Deploy additional network-level monitoring to detect and alert on suspicious property modification attempts
• Consider implementing additional input validation at the network perimeter using WAF rules

# Example: Audit Guardian properties for HTML injection patterns
# Review CMC logs for suspicious Guardian configuration changes
grep -E "<[a-zA-Z]|%3C|<" /var/log/cmc/guardian-properties.log

# List recent Guardian property modifications
grep "property_update" /var/log/cmc/audit.log | tail -50