CVE-2025-40894: HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-04 · updated 2026-06-17
Weakness: CWE-79

Description

A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parameter. A malicious authenticated user with the required privileges could edit a node label to inject HTML tags. If the system is configured to use the Alerted Nodes Dashboard, and alerts are reported for the affected node, then the injected HTML may render in the browser of a victim user interacting with it, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.

Affected products

Nozomi Networks CMC: before 25.6.0 — fixed in 25.6.0
Nozomi Networks Guardian: before 25.6.0 — fixed in 25.6.0

How to fix

Upgrade to a fixed version: Nozomi Networks CMC 25.6.0; Nozomi Networks Guardian 25.6.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-40894 or the next vulnerability affects your stack