CVE-2025-40894: 
NixOS vulnerability analysis and mitigation

CVE-2025-40894 is a Stored HTML Injection vulnerability in the Alerted Nodes Dashboard functionality of Nozomi Networks Guardian and CMC products, caused by improper validation of an input parameter. A malicious authenticated user with sufficient privileges can edit a node label to inject HTML tags, which may render in the browsers of other users when alerts are triggered for the affected node. The vulnerability affects Nozomi Networks Guardian and CMC versions prior to 25.6.0. It was published on March 4, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (Nozomi Advisory).

The root cause is improper neutralization of input during web page generation (CWE-79), specifically in the node label input field of the Alerted Nodes Dashboard. An authenticated attacker with the required privileges can store malicious HTML tags in a node label; when the system is configured to use the Alerted Nodes Dashboard and alerts are generated for that node, the injected HTML renders in victim users' browsers. The attack vector is network-based, requires low privileges, and necessitates user interaction (a victim viewing the dashboard). Full XSS exploitation is prevented by existing input validation and Content Security Policy (CSP) configuration, limiting the impact to phishing and potential open redirect attacks (Nozomi Advisory).

Successful exploitation enables a malicious authenticated user to conduct phishing attacks or open redirect attacks against other users who interact with the Alerted Nodes Dashboard. Injected HTML content renders in victim browsers when alerts are reported for the affected node, potentially facilitating credential theft or unauthorized redirects. Full XSS exploitation and direct information disclosure are mitigated by the existing CSP configuration, limiting the practical impact to social engineering scenarios (Nozomi Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.028%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated user with specific privileges to modify node labels, and victim interaction with the Alerted Nodes Dashboard is also required (Nozomi Advisory).

1. Gain authenticated access: Obtain credentials for a Nozomi Networks Guardian or CMC account with privileges to edit node labels (e.g., an operator or administrator role).
2. Identify target node: Locate a node that is likely to generate alerts and appear in the Alerted Nodes Dashboard, which victim users regularly monitor.
3. Inject HTML payload: Edit the node label to include malicious HTML tags — for example, an anchor tag with an href pointing to a phishing site or an open redirect URL (e.g., <a href="https://attacker.com">Click here</a>).
4. Wait for alert trigger: Allow the system to generate an alert for the affected node, which causes the Alerted Nodes Dashboard to display the node label.
5. Victim interaction: When a victim user views the Alerted Nodes Dashboard and the injected HTML renders in their browser, they may be redirected to a malicious site or presented with a phishing interface, potentially leading to credential theft (Nozomi Advisory).

• Logs: Audit logs showing unexpected modifications to node labels by non-administrative or low-privileged accounts; review Guardian/CMC change logs for node label edits containing HTML tag characters (<, >, href, etc.).
• Network: Outbound connections from user browsers to unexpected external domains after interacting with the Alerted Nodes Dashboard, potentially indicating a successful open redirect.
• Application: Node labels in the Alerted Nodes Dashboard containing raw HTML markup (e.g., <a>, <img>, <iframe> tags) rather than plain text identifiers.

Nozomi Networks has released a patch in version 25.6.0 of both Guardian and CMC, which addresses the improper input validation. Organizations should update to version 25.6.0 or later as the primary remediation step. As interim mitigations, restrict dashboard access to trusted and necessary users only, monitor for suspicious node label modifications in audit logs, and review Alerted Nodes Dashboard access controls. The existing Content Security Policy already provides partial protection against full XSS exploitation (Nozomi Advisory).

The vulnerability received limited public attention, with automated CVE tracking services and vulnerability databases (Vulners, VulnDB, CIRCL) indexing the disclosure shortly after publication. A brief mention appeared on Bluesky via CVE tracking accounts. No significant researcher commentary, vendor statements beyond the official advisory, or major media coverage has been identified (Nozomi Advisory).