SQL Injection Vulnerability in Smart Polling Functionality by Nozomi Networks
CVE-2025-40885

6MEDIUM

Key Information:

Vendor

Nozomi Networks

Status
Guardian
Cmc
Vendor
CVE Published:
7 October 2025

What is CVE-2025-40885?

A SQL Injection vulnerability exists in the Smart Polling functionality of Nozomi Networks due to inadequate input parameter validation. This flaw enables an authenticated user with limited privileges to execute arbitrary SELECT SQL statements against the underlying database management system, which can result in unauthorized exposure of sensitive data.

Affected Version(s)

CMC 0 < 25.2.0

Guardian 0 < 25.2.0

References

https://security.nozominetworks.com/NN-2025:6-01

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was found by Andrea Palanca of Nozomi Networks Product Security team during an internal investigation.
JSON
.
CVE-2025-40885 : SQL Injection Vulnerability in Smart Polling Functionality by Nozomi Networks