CVE-2026-31981 : faille moyenne nozominetworks cmc (CVSS 4.8)

A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data through multiple input vectors. When a victim views the affected data in the Diagram tab and Graph view, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.

Sévérité

Moyenne (CVSS 4.8)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitation active

Non signalée par la CISA

Publication

9 juil. 2026

Dernière mise à jour

11 août 2026

• nozominetworks cmc
• nozominetworks guardian

• Fiche CVE-2026-31981 sur le NVD (NIST)
• security.nozominetworks.com/NN-2026:8-01
• cert-portal.siemens.com/productcert/html/ssa-827968.html