CVE-2025-40893: 
NixOS vulnerability analysis and mitigation

CVE-2025-40893 is a Stored HTML Injection vulnerability in the Asset List functionality of Nozomi Networks Guardian and CMC products. It arises from improper validation of network traffic data, allowing an unauthenticated attacker to inject HTML tags into asset attributes via specially crafted network packets. Affected versions are all releases of Guardian and CMC prior to 25.5.0. The vulnerability was published on December 18, 2025, with a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Nozomi Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored variant where attacker-controlled data persists in the application and is later rendered in victims' browsers. An unauthenticated attacker sends specially crafted network packets whose payload is ingested by the Guardian/CMC sensor and stored as asset attributes; when an authenticated user views the Asset List or similar views, the injected HTML is rendered by the browser. Full cross-site scripting (XSS) exploitation is constrained by existing server-side input validation and a Content Security Policy (CSP), limiting the attack surface to HTML injection enabling phishing and open redirect scenarios rather than arbitrary script execution (Nozomi Advisory).

Successful exploitation enables an attacker to render arbitrary HTML in the browsers of authenticated users who view the affected Asset List, facilitating phishing attacks (e.g., fake login forms) and open redirect attacks that could lead to credential theft or redirection to malicious sites. Confidentiality and integrity impacts are limited (low) due to the CSP preventing full script execution and direct information disclosure. Availability is not impacted, and the scope is changed since the injected content affects the victim's browser context rather than the server itself (Nozomi Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.028%, reflecting a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Nozomi Advisory).

1. Reconnaissance: Identify network segments monitored by Nozomi Networks Guardian or CMC sensors running versions prior to 25.5.0.
2. Craft malicious network packets: Construct network packets (e.g., crafted protocol responses or device banners) containing HTML tags (e.g., <a href="https://malicious.example.com">Click here</a> or <img src=x onerror=...>) embedded in fields that Guardian/CMC will parse and store as asset attributes (such as device hostname, description, or banner fields).
3. Transmit packets: Send the crafted packets onto the monitored network so that the Guardian/CMC sensor ingests and stores the malicious HTML as part of an asset's attributes — no authentication is required for this step.
4. Wait for victim interaction: When an authenticated administrator or analyst views the Asset List or a related view in the Guardian/CMC web interface, the stored HTML renders in their browser.
5. Achieve objective: The rendered HTML can display a phishing form to harvest credentials, or redirect the victim to an attacker-controlled site via an open redirect link (Nozomi Advisory).

• Network: Unusual network packets containing HTML tag sequences (e.g., <a, <img, <iframe, <form) in protocol fields typically used for device identification (hostnames, banners, descriptions) on monitored network segments.
• Logs: Guardian/CMC application logs showing asset attribute values containing HTML markup characters (<, >, href=, src=) stored for network assets.
• Web/Browser: Unexpected HTML elements (links, images, forms) rendering within the Asset List view of the Guardian or CMC web interface; browser developer tools showing injected DOM elements not consistent with normal asset data.
• User Reports: Authenticated users reporting unexpected redirects or unfamiliar login prompts appearing within the Guardian/CMC Asset List interface.

Nozomi Networks has released a patch in version 25.5.0 of both Guardian and CMC; organizations should upgrade to this version or later as the primary remediation (Nozomi Advisory). As interim mitigations, implement network segmentation to restrict which devices and traffic sources can reach the monitored network segments ingested by Guardian/CMC sensors, and monitor for network traffic containing HTML injection payloads in protocol fields. Access to the Guardian/CMC web interface should be restricted to trusted administrators until patching is complete.