PT-2026-22914 · Unknown · Alerted Nodes Dashboard

CVE-2025-40894 · Publicado 2026-03-04 · Atualizado 2026-03-05

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alerted Nodes Dashboard (affected versions not specified)

Description A stored HTML injection issue exists due to inadequate validation of an input parameter within the Alerted Nodes Dashboard functionality. A malicious, authenticated user possessing the necessary privileges can modify a node label to inject HTML tags. If the Alerted Nodes Dashboard is enabled and alerts are generated for the compromised node, the injected HTML may be displayed in a victim user's browser, potentially leading to phishing or open redirect attacks. Existing input validation and Content Security Policy configurations prevent full cross-site scripting (XSS) exploitation and direct information disclosure. The vulnerable parameter is the node label.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-40894

Produtos afetados

Alerted Nodes Dashboard

Referências · 5

• https://cert-portal.siemens.com/productcert/html/ssa-827968.html · Nota
• https://security.nozominetworks.com/NN-2025:16-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-40894 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-40894 · Aviso do Fabricante
• https://t.me/cveNotify/154369 · Publicação no Telegram