Nozomi Guardian/CMC up to 26.1.x Diagram tab/Graph view cross site scripting

Summaryinfo

A vulnerability marked as problematic has been reported in Nozomi Guardian and CMC up to 26.1.x. Affected by this vulnerability is an unknown functionality of the component Diagram tab/Graph view. Performing a manipulation results in cross site scripting. This vulnerability is reported as CVE-2026-31981. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Nozomi Guardian and CMC up to 26.1.x. This affects an unknown code of the component Diagram tab/Graph view. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data through multiple input vectors. When a victim views the affected data in the Diagram tab and Graph view, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.

The advisory is shared at security.nozominetworks.com. This vulnerability is uniquely identified as CVE-2026-31981 since 03/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are required for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading to version 26.2.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Nozomi

Name

• CMC
• Guardian

Version

• 26.0
• 26.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion