Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2025-40885

Authenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Nozomi

Description

A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Nozomi Networks Guardian

Default version status: unaffected

  • 0 to < 25.2.0affected

Nozomi Networks CMC

Default version status: unaffected

  • 0 to < 25.2.0affected

References