CVE-2025-40892

CVE-2025-40892 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability affecting Nozomi Networks CMC and Guardian products. An authenticated user with report privileges can inject malicious JavaScript into reports, or a victim can be socially engineered to import a malicious report template. This allows an attacker to execute arbitrary code in the victim's browser, potentially leading to unauthorized data modification, denial of service, or limited sensitive information disclosure. The vulnerability has a CVSS score of 8.9 (High) due to its network attack vector, low complexity, and significant impact on integrity and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.