Security readout for executives and security teams
Plain-English summary
A flaw in Nozomi Networks Guardian and CMC lets a logged-in user with report permissions embed malicious code inside a report, or trick a colleague into importing one. When someone views that report, the hidden code runs in their browser and can alter data or interrupt the app. Existing safeguards limit the damage, but operational disruption is possible in OT monitoring environments.
Executive priority
Plan a scheduled upgrade to 26.1.0 during the next available OT maintenance window. Not an emergency: no known exploitation, medium severity, and safeguards limit blast radius. Prioritize sites where many operators can author or import reports, especially critical-infrastructure environments where a data-tampering or availability event could delay incident detection or response.
Technical view
CVE-2025-40900 is an Angular template injection (CWE-1336) in the Reports feature of Nozomi Networks Guardian and CMC before 26.1.0. An authenticated user with report privileges, or a socially engineered victim importing a report, can trigger template evaluation in the browser context. Content Security Policy and input validation block full XSS and direct data disclosure, but attackers can modify application data or degrade availability. CVSS 4.0 base score is 5.1.
Likely exposure
Exposure is limited to organizations running Guardian or CMC below 26.1.0 where users hold report privileges or accept report imports. Since these are OT/ICS monitoring platforms, exposure concentrates in industrial, utility, and critical-infrastructure operators. Attack requires authentication plus victim interaction, so exposure grows with the number of report authors and analysts who can import external report templates.
Exploitation context
No public reports of active exploitation and the flaw is not listed in CISA KEV. Exploitation requires an authenticated attacker with report privileges or a successful social-engineering step where a victim imports a malicious report. Impact is capped by CSP and input validation: data integrity and availability are at risk, but confidentiality and full XSS are not per the vendor advisory.
Researcher notes
Angular template injection (CWE-1336) in the Reports parameter path. Attacker vector requires PR:L and UI:P per the CVSS 4.0 vector, aligning with the two described paths: privileged report author or victim-imported template. Vendor states CSP and input validation prevent full XSS and information disclosure, so realistic impact is data integrity and denial-of-view within the app. Confirm 26.1.0 upgrade closes the sink; no CVE-listed mitigation short of patching is provided.
Mitigation direction
- Upgrade Guardian and CMC to version 26.1.0 or later as directed by Nozomi Networks advisory NN-2026:3-01.
- Review Siemens SSA-827968 for OEM-branded Nozomi deployments and follow Siemens ProductCERT guidance.
- Restrict report authoring and import privileges to a minimum set of trusted users.
- Warn analysts not to import report templates received from untrusted or unverified sources.
- Confirm Content Security Policy is not weakened by local customizations that could remove existing safeguards.
Validation and detection
- Inventory all Guardian and CMC instances and record their exact version against the 26.1.0 fixed release.
- Audit user accounts holding report privileges and remove entitlements no longer required.
- Review recent report definitions and imports for unexpected Angular expressions or unfamiliar authors.
- Verify CSP headers on Guardian and CMC web interfaces match vendor defaults.
- Track vendor advisory pages NN-2026:3-01 and SSA-827968 for updated fix or mitigation guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1336: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-40900 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N——NozomiCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L2.12.5NozomiVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Base CVSS 3.1 score
4.6MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://security.nozominetworks.com/NN-2026:3-01CVE reference, Nozomi
- https://cert-portal.siemens.com/productcert/html/ssa-827968.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements Used in a Template Engine
Improper Neutralization of Special Elements Used in a Template Engine represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.