PT-2026-22914 · Unknown · Alerted Nodes Dashboard

Published 2026-03-04 · Updated 2026-03-05 · CVE-2025-40894

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alerted Nodes Dashboard (affected versions not specified)

Description A stored HTML injection issue exists due to inadequate validation of an input parameter within the Alerted Nodes Dashboard functionality. A malicious, authenticated user possessing the necessary privileges can modify a node label to inject HTML tags. If the Alerted Nodes Dashboard is enabled and alerts are generated for the compromised node, the injected HTML may be displayed in a victim user's browser, potentially leading to phishing or open redirect attacks. Existing input validation and Content Security Policy configurations prevent full cross-site scripting (XSS) exploitation and direct information disclosure. The vulnerable parameter is the node label.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40894

Affected Products

Alerted Nodes Dashboard

References · 5

• https://security.nozominetworks.com/NN-2025:16-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40894 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40894 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-827968.html · Note
• https://t.me/cveNotify/154369 · Telegram Post