CVE-2025-40887

MEDIUM

Nozomi Networks CMC and Guardian < 25.2.0 - Authenticated SQL Injection via Alert Input Parameter

Title source: llm

Description

A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data.

References (1)

Core 1

Core References

Vendor Advisory

https://security.nozominetworks.com/NN-2025:8-01

Scores

CVSS v3 5.3

EPSS 0.0022

EPSS Percentile 12.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (2)

nozominetworks/cmc < 25.2.0

nozominetworks/guardian < 25.2.0

Published Oct 07, 2025

Tracked Since Feb 18, 2026