SQL Injection Vulnerability in Alert Functionality of Nozomi Networks Software
CVE-2025-40887

6MEDIUM

Key Information:

Vendor: Nozomi Networks
Status: Guardian; Cmc
Vendor: CVE Published:; 7 October 2025

🔔 Create Nozomi Networks Vulnerability Alert

What is CVE-2025-40887?

An SQL Injection vulnerability has been identified in the Alert functionality of Nozomi Networks Software, resulting from the inadequate validation of input parameters. This flaw allows authenticated users with limited privileges to execute arbitrary SELECT SQL statements on the underlying database management system (DBMS). Consequently, this vulnerability may lead to unauthorized access to sensitive data within the application, highlighting the need for robust security measures and thorough input validation.

Affected Version(s)

CMC 0 < 25.2.0

Guardian 0 < 25.2.0

References

https://security.nozominetworks.com/NN-2025:8-01

CVSS V4

Score:

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

High

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 7, 2025
Vulnerability Reserved
Apr 16, 2025

Credit

This issue was found by Andrea Palanca of Nozomi Networks Product Security team during an internal investigation.

JSON