CVE-2025-40903: Nozomi Networks Guardian and CMC HTML injection in Schedule Restore Archive

CVE-2025-40903 · Severity: medium · CVSS 5.9 · Published 2026-05-19

Nozomi Networks Guardian and CMC appliances, which are used to monitor and manage industrial control systems, contain a security flaw in their archive restoration scheduling feature. An authorized administrator can inject malicious code into a schedule that will execute in the browser of other users who view it. This could be used to perform phishing attacks or redirect users to malicious websites, though existing security controls prevent full data theft or complete system takeover.

Technologies: Nozomi Networks Central Management Console, Nozomi Networks Guardian. Vendors: Nozomi Networks.

Quick answers

Is CVE-2025-40903 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-40903 being exploited in the wild.
How severe is CVE-2025-40903?
Medium severity, with a CVSS score of 5.9, published 19 May 2026.
Which products and versions are affected?
Nozomi Networks Central Management Console < 26.1.0; Nozomi Networks Guardian < 26.1.0.
Is there a fix for CVE-2025-40903?
A patch was published on 2026-05-19: Fixed in version 26.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-40903 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-40903?
Check whether you run Nozomi Networks Central Management Console or Nozomi Networks Guardian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Stored HTML Injection vulnerability (CWE-79) exists in the Schedule Restore Archive functionality of Nozomi Networks Guardian and CMC due to improper validation of input parameters. An authenticated attacker with high privileges (administrative access) can define a restore schedule containing malicious HTML tags. When a victim views the schedule, the browser renders the injected HTML. While the vulnerability allows for phishing and open redirects, full Cross-Site Scripting (XSS) and direct information disclosure are mitigated by existing input validation and a restrictive Content Security Policy (CSP). The issue is fixed in version 26.1.0.

Affected products

  • Nozomi Networks Guardian < 26.1.0
  • Nozomi Networks Central Management Console (CMC) < 26.1.0

Timeline

  • 2026-05-19: disclosed: Initial discovery by Nozomi Networks internal security team.
  • 2026-05-19: advisory
  • 2026-05-19: patched: Fixed in version 26.1.0.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.