2.1
Low
CVE-2025-40894 A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper…
Description
A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parameter. A malicious authenticated user with the required privileges could edit a node label to inject HTML tags. If the system is configured to use the Alerted Nodes Dashboard, and alerts are reported for the affected node, then the injected HTML may render in the browser of a victim user interacting with it, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RUGGEDCOM APE1808 | Versions not published | |
| Guardian 25.6 | earliest → < 25.6.0 | 25.6.0 |
| CMC 25.6 | earliest → < 25.6.0 | 25.6.0 |
References
- security.nozominetworks.com security.nozominetworks.com
Timeline
- Published
- Last modified
Other CVEs of RUGGEDCOM APE1808
The 99 CVEs of RUGGEDCOM APE1808 →
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
9.2
Critical
CVE-2026-109619
RCE via stale global state
9.2
Critical
CVE-2026-109618
RCE via OOM corruption
9.2
Critical
CVE-2026-0308
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious…
1.1
Low