CVE-2025-40892

Katalog CVE

CVSS 8.9 · High EPSS 0,26%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada nozominetworks cmc, nozominetworks guardian. Skor CVSS 3.1 8.9 (High) menurut NVD.

Deskripsi (NVD)

A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.

Rincian

Terbit di NVD

18 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.9 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 15,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.nozominetworks.com/NN-2025:13-01 mitigasi · advisory vendor
• https://cert-portal.siemens.com/productcert/html/ssa-827968.html