CVE-2025-40891: 
NixOS vulnerability analysis and mitigation

CVE-2025-40891 is a Stored HTML Injection vulnerability in the Time Machine Snapshot Diff functionality of Nozomi Networks Guardian and CMC products. It arises from improper validation of network traffic data, allowing an unauthenticated attacker to inject HTML tags into asset attributes by sending specially crafted network packets at two different times. Affected products are Nozomi Networks Guardian and CMC versions prior to 25.5.0. The vulnerability was published on December 18, 2025, with a CVSS v3.1 base score of 4.7 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (Nozomi Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting), specifically a stored variant where malicious input persists in the application's data. An unauthenticated attacker sends specially crafted network packets at two distinct points in time, causing HTML tags to be injected into asset attributes that are later compared across two snapshots in the Time Machine Snapshot Diff feature. Exploitation requires a victim to navigate to the affected snapshots and perform specific GUI interactions, at which point the injected HTML renders in their browser, enabling phishing and open redirect attacks. Full XSS exploitation is mitigated by existing input validation and a Content Security Policy (CSP), making attack complexity high (Nozomi Advisory).

Successful exploitation enables phishing attacks and open redirect attacks against users who interact with the affected Time Machine Snapshot Diff feature, potentially leading to credential theft or redirection to malicious sites. Confidentiality and integrity impacts are rated as low, and there is no availability impact. The scope is changed (affecting the victim's browser context), but full script execution is blocked by the application's CSP (Nozomi Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.021%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Attack complexity is rated High due to the multiple preconditions required: the attacker must send crafted packets at two specific times, and a victim must subsequently use the Snapshot Diff feature and perform specific GUI actions (Nozomi Advisory).

1. Reconnaissance: Identify a target environment running Nozomi Networks Guardian or CMC versions prior to 25.5.0 with the Time Machine feature enabled.
2. First packet injection: Send a specially crafted network packet containing HTML tags in fields that will be captured as asset attributes during the first snapshot period.
3. Second packet injection: At a later time, send a second crafted packet to create a differing asset attribute value in a subsequent snapshot, ensuring the injected HTML appears as a change between the two snapshots.
4. Wait for victim interaction: Wait for a legitimate user (e.g., a security analyst) to open the Time Machine Snapshot Diff view comparing the two affected snapshots and perform the specific GUI actions that trigger rendering of the diff output.
5. HTML renders in browser: The injected HTML tags render in the victim's browser, enabling phishing content display or open redirect to an attacker-controlled URL, potentially harvesting credentials or redirecting the victim to a malicious site (Nozomi Advisory).

• Network: Unusual or malformed network packets with HTML tag content (e.g., <a href=...>, <img src=...>, <script>) in fields typically used for asset identification or metadata, observed at two distinct time intervals.
• Logs: Application logs showing unexpected HTML characters or tags stored in asset attribute fields within the Time Machine snapshot data.
• User Activity: Analyst reports of unexpected redirects or phishing-style content appearing within the Nozomi Networks Guardian or CMC web interface, specifically in the Time Machine Snapshot Diff view.

Nozomi Networks has released a patch in version 25.5.0 of both Guardian and CMC, which addresses this vulnerability. Organizations should upgrade to version 25.5.0 or later as the primary remediation. As an interim measure, security teams should be aware that the built-in Content Security Policy provides partial protection against full XSS exploitation. Additionally, monitoring for suspicious network traffic patterns and restricting access to the Time Machine Snapshot Diff feature to trusted users can reduce exposure (Nozomi Advisory).