Nozomi Guardian/CMC up to 25.4.x Time Machine Snapshot Diff Feature cross site scripting

Summaryinfo

A vulnerability has been found in Nozomi Guardian and CMC up to 25.4.x and classified as problematic. Impacted is an unknown function of the component Time Machine Snapshot Diff Feature. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2025-40891. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in Nozomi Guardian and CMC up to 25.4.x. Affected by this vulnerability is an unknown part of the component Time Machine Snapshot Diff Feature. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network packets at two different times to inject HTML tags into asset attributes across two snapshots. Exploitation requires a victim to use the Time Machine Snapshot Diff feature on those specific snapshots and perform specific GUI actions, at which point the injected HTML renders in their browser, enabling phishing and open redirect attacks. Full XSS exploitation is prevented by input validation and Content Security Policy. Attack complexity is high due to multiple required conditions.

It is possible to read the advisory at security.nozominetworks.com. This vulnerability is known as CVE-2025-40891 since 04/16/2025. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Upgrading to version 25.5.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Nozomi

Name

• CMC
• Guardian

Version

• 25.0
• 25.1
• 25.2
• 25.3
• 25.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion