CVEFinder.io

CVE-2026-31981

🔶 medium
Summary

A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data through multiple input vectors. When a victim views the affected data in the Diagram tab and Graph view, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation

Description

A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data through multiple input vectors. When a victim views the affected data in the Diagram tab and Graph view, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.

CVSS Score
5.9
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-09
First Seen: 2026-07-10
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 32.1% of all 365,968 vulnerabilities in our database.

#248,481
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 9, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
This issue was found by Stefano Libero and Andrea Palanca of Nozomi Networks Product Security team during an internal investigation.
SSVC data provided by CISA
Last Modified 2026-08-11
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)
CWE-79

📦 Affected Products 2

Vendor Product Status Affected Versions
nozominetworks guardian Affected
< 26.2.0
nozominetworks cmc Affected
< 26.2.0

🔗 References 2

https://security.nozominetworks.com/NN-2026:8-01
Mitigation Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa...

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-31982 ⚠️ high 7.1 0.2 An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of... 2026-07-09
CVE-2026-31983 🔶 medium 5.3 0.2 A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attac... 2026-07-09
CVE-2026-31984 ⚠️ high 7.5 0.3 A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functional... 2026-07-09
CVE-2026-33390 ⚠️ high 8.1 0.2 An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors r... 2026-07-09
CVE-2025-40900 🔶 medium 4.6 0.2 An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an... 2026-05-19
CVE-2025-40901 🔶 medium 5.9 0.2 A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation... 2026-05-19
These CVEs affect the same products