📄 Description (English)
A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious restore schedule containing HTML tags. When a victim views the affected schedule, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.
🤖 AI Executive Summary
CVE-2025-40903 is a stored HTML injection vulnerability in Nozomi Networks CMC and Guardian products affecting the Schedule Restore Archive functionality. An authenticated administrator can inject malicious HTML tags into restore schedules, which render when viewed by other users, enabling phishing and open redirect attacks. While full XSS exploitation is mitigated by existing CSP, the vulnerability poses a significant social engineering risk in critical infrastructure environments. No patch is currently available, requiring immediate compensating controls.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 24, 2026 11:19
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability poses significant risk to Saudi critical infrastructure operators, particularly: (1) Energy sector (ARAMCO, regional utilities) using Nozomi Guardian for OT/ICS monitoring — phishing attacks could compromise operator credentials and enable lateral movement; (2) Government agencies and NCA-regulated entities using CMC for network management — administrative credential compromise could lead to unauthorized access; (3) Telecom operators (STC, Mobily) managing backup/restore operations — social engineering attacks targeting backup administrators could disrupt service continuity; (4) Healthcare facilities using these platforms for infrastructure management — phishing could compromise patient data access controls. The requirement for administrative privileges limits immediate risk, but insider threat and credential compromise scenarios are elevated.
🏢 Affected Saudi Sectors
Energy (ARAMCO, utilities)
Government (NCA-regulated entities)
Telecommunications (STC, Mobily)
Healthcare
Critical Infrastructure/OT
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
6.8
/ 10.0
🔧 Remediation Steps (English)
Immediate Actions:
1. Audit all Schedule Restore Archive configurations in CMC and Guardian instances for suspicious HTML content or unusual schedule definitions
2. Restrict administrative access to Schedule Restore Archive functionality to essential personnel only
3. Implement multi-factor authentication (MFA) for all administrative accounts with access to scheduling functions
4. Review access logs for unauthorized schedule modifications in the past 90 days
Compensating Controls (pending patch):
5. Deploy email filtering rules to block messages containing links from internal administrative accounts if phishing is suspected
6. Implement network segmentation to isolate CMC/Guardian administrative interfaces from general user networks
7. Configure browser security policies to disable HTML rendering in administrative dashboards where feasible
8. Establish mandatory security awareness training for administrators on phishing and social engineering tactics
9. Implement input validation at the application layer to strip HTML tags from schedule parameters (if configuration allows)
10. Monitor for suspicious redirect patterns in web logs and network traffic from CMC/Guardian systems
Detection Rules:
- Alert on Schedule Restore Archive modifications containing HTML tags (<, >, script, iframe, onclick, href with javascript:)
- Monitor for administrative account logins followed by schedule configuration changes
- Track failed authentication attempts against administrative accounts
- Log and alert on any schedule viewing events by non-administrative users
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تدقيق جميع تكوينات جدولة استعادة الأرشيف في مثيلات CMC و Guardian للبحث عن محتوى HTML مريب أو تعريفات جدول غير عادية
2. تقييد الوصول الإداري إلى وظيفة جدولة استعادة الأرشيف للموظفين الأساسيين فقط
3. تنفيذ المصادقة متعددة العوامل (MFA) لجميع الحسابات الإدارية التي لها وصول إلى وظائف الجدولة
4. مراجعة سجلات الوصول للتعديلات غير المصرح بها على الجدول في آخر 90 يوماً
الضوابط التعويضية (في انتظار التصحيح):
5. نشر قواعد تصفية البريد الإلكتروني لحظر الرسائل التي تحتوي على روابط من الحسابات الإدارية الداخلية إذا كان التصيد مريباً
6. تنفيذ تقسيم الشبكة لعزل واجهات CMC/Guardian الإدارية عن شبكات المستخدمين العامة
7. تكوين سياسات أمان المتصفح لتعطيل عرض HTML في لوحات المعلومات الإدارية حيث أمكن
8. إنشاء تدريب إلزامي على الوعي الأمني للمسؤولين حول التصيد والهندسة الاجتماعية
9. تنفيذ التحقق من صحة الإدخال على مستوى التطبيق لإزالة علامات HTML من معاملات الجدول (إذا سمحت التكوين)
10. مراقبة أنماط إعادة التوجيه المريبة في سجلات الويب وحركة المرور من أنظمة CMC/Guardian
قواعد الكشف:
- تنبيه على تعديلات جدولة استعادة الأرشيف التي تحتوي على علامات HTML (<، >، script، iframe، onclick، href مع javascript:)
- مراقبة تسجيلات الحساب الإداري متبوعة بتغييرات تكوين الجدول
- تتبع محاولات المصادقة الفاشلة ضد الحسابات الإدارية
- تسجيل والتنبيه على أي أحداث عرض جدول من قبل المستخدمين غير الإداريين
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.5.1.1 - Access Control: Restrict administrative access to critical functions
ECC 2024 A.6.1.2 - User Authentication: Implement MFA for privileged accounts
ECC 2024 A.7.1.1 - Cryptography and Data Protection: Validate and sanitize user inputs
ECC 2024 A.8.1.3 - Audit and Accountability: Monitor and log administrative activities
🔵 SAMA CSF
SAMA CSF ID.AM-2: Inventory of hardware and software assets
SAMA CSF PR.AC-1: Access control policies and procedures
SAMA CSF PR.AC-4: Access rights and privileges management
SAMA CSF DE.CM-1: System monitoring and anomaly detection
SAMA CSF RS.AN-1: Incident analysis and response
🟡 ISO 27001:2022
ISO 27001:2022 A.5.15 - Access Control: Restrict access to information and systems
ISO 27001:2022 A.5.16 - Authentication: Implement strong authentication mechanisms
ISO 27001:2022 A.5.18 - Cryptography: Protect information through cryptographic controls
ISO 27001:2022 A.8.22 - Monitoring: Monitor and review information security activities
ISO 27001:2022 A.8.32 - Change Management: Control changes to information systems
🔗 References & Sources 1
📦 Affected Products / CPE 2 entries
nozominetworks:cmc
nozominetworks:guardian