Vulnerability Description
A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nozominetworks | Cmc | < 25.5.0 |
| Nozominetworks | Guardian | < 25.5.0 |
Related Weaknesses (CWE)
References
- https://security.nozominetworks.com/NN-2025:13-01MitigationVendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-827968.html
FAQ
What is CVE-2025-40892?
CVE-2025-40892 is a vulnerability with a CVSS score of 8.9 (HIGH). A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a mali...
How severe is CVE-2025-40892?
CVE-2025-40892 has been rated HIGH with a CVSS base score of 8.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-40892?
Check the references section above for vendor advisories and patch information. Affected products include: Nozominetworks Cmc, Nozominetworks Guardian.