Vulnerability Description
A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network packets to inject HTML tags into asset attributes. When a victim views the affected assets in the Asset List (and similar functions), the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nozominetworks | Cmc | < 25.5.0 |
| Nozominetworks | Guardian | < 25.5.0 |
Related Weaknesses (CWE)
References
- https://security.nozominetworks.com/NN-2025:14-01Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-827968.html
FAQ
What is CVE-2025-40893?
CVE-2025-40893 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network ...
How severe is CVE-2025-40893?
CVE-2025-40893 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-40893?
Check the references section above for vendor advisories and patch information. Affected products include: Nozominetworks Cmc, Nozominetworks Guardian.