CVE-2025-40890 Details

A stored cross-site scripting vulnerability has been identified in the Dashboards feature of Nozomi Networks Guardian and CMC versions prior to 25.4.0. This vulnerability arises from inadequate validation of input parameters, allowing authenticated low-privilege users to create malicious dashboards embedded with JavaScript payloads. These dashboards can be shared with other users or, alternatively, victims can be tricked into importing a harmful dashboard template. Once the dashboard is viewed or imported, the embedded script executes in the user's browser, enabling the attacker to perform unauthorized actions on behalf of the victim. This could include modifying application data, disrupting service availability, and accessing restricted sensitive information.

Users are advised to upgrade to Nozomi Networks Guardian or CMC version 25.4.0 or later. Additionally, it is recommended to use internal firewall features to restrict access to the web management interface and to review and remove unnecessary accounts with access to this interface.