Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
Guardian Properties Can Be Injected with Malicious HTML on CMC Sensor Map
CVE-2025-40895
Summary
Authenticated users with admin access to a connected Guardian can inject malicious code into the CMC's Sensor Map, potentially allowing them to trick users into revealing sensitive information or visiting fake websites. This can happen when a user interacts with the Sensor Map on their CMC. To protect your system, ensure that input validation and Content Security Policy configurations are up to date and that users only access the Sensor Map through trusted environments.
Original title
A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map functionality due to improper validation on connected Guardians' properties.
A malicious authenticated user with admi...
Original description
A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map functionality due to improper validation on connected Guardians' properties.
A malicious authenticated user with administrator privileges on a Guardian connected to a CMC can edit the Guardian's properties to inject HTML tags. If the Sensor Map functionality is enabled in the CMC, when a victim CMC user interacts with it, then the injected HTML may render in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.
A malicious authenticated user with administrator privileges on a Guardian connected to a CMC can edit the Guardian's properties to inject HTML tags. If the Sensor Map functionality is enabled in the CMC, when a victim CMC user interacts with it, then the injected HTML may render in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.
osv CVSS4.0
7.3
- https://security.nozominetworks.com/NN-2025:17-01 Vendor Advisory
Published: 4 Mar 2026 · Updated: 13 Mar 2026 · First seen: 13 Mar 2026