CVE-2025-40903

Vulnerability

A Stored HTML Injection vulnerability exists in the Schedule Restore Archive functionality of Nozomi Networks Guardian and CMC products prior to version 26.1.0. The flaw arises from improper validation of an input parameter used when defining a restore schedule. An authenticated user with administrative privileges can inject arbitrary HTML tags into the schedule name or description [1].

Exploitation

An attacker must have administrative access to the web management interface. The attacker creates or modifies a restore schedule, inserting malicious HTML tags (e.g., `` elements pointing to an attacker-controlled site). When any other user views the affected schedule in the management interface, the injected HTML is rendered in their browser [1].

Impact

The injected HTML can be used for phishing attacks (displaying fake login forms or prompts) and open redirect attacks (convincing users to click a link that redirects outside the application). Full cross-site scripting (XSS) and direct information disclosure are not possible due to existing input validation and Content Security Policy (CSP) measures [1].

Mitigation

Upgrade to version 26.1.0 or later, which contains the fix. If immediate upgrade is not possible, restrict network access to the web management interface via internal firewall rules and review accounts with administrative privileges to remove unnecessary ones [1].