Read the docs
TI-2025-27284 Aliases CVE-2025-40890GHSA-jgq4-7gr6-r8rv

Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be socially engineered to import a malicious dashboard template. When the victim views or imports the dashboard, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00208 10th percentileScored 2026-11-07
Fix Fixed Guardian (Nozomi Networks): 25.4.0CMC (Nozomi Networks): 25.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Nozomi NetworksGuardianbefore 25.4.025.4.0Patch availableCNA
Nozomi NetworksCMCbefore 25.4.025.4.0Patch availableCNA
  • Guardian VendorNozomi Networks Affected before 25.4.0 Fixed in 25.4.0 Patch available CNA
  • CMC VendorNozomi Networks Affected before 25.4.0 Fixed in 25.4.0 Patch available CNA

Remediation

  • Fix · CNA Guardian (Nozomi Networks) Fixed in 25.4.0
  • Fix · CNA CMC (Nozomi Networks) Fixed in 25.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-40890
  2. 2026-10-03 Alias added: GHSA-jgq4-7gr6-r8rv

References

Other 1

  • TI-2022-00470 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 CVSS 4.0HIGH 8.6
  • TI-2026-24526 DoS through oversized audit log entries in Guardian/CMC before 26.2.0 CVSS 4.0HIGH 8.7
  • TI-2023-15926 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 CVSS 4.0HIGH 8.2
  • TI-2023-13657 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 CVSS 4.0CRITICAL 9.2
  • TI-2024-00196 DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1 CVSS 4.0HIGH 8.2
  • TI-2021-08402 Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4 CVSS 4.0HIGH 8.6
See all 64 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences