Executive Summary

CVE-2025-40904 is a Stored HTML Injection vulnerability found in the Smart Polling feature of Guardian and CMC software versions before 26.1.0. It occurs because of improper validation of an input parameter, which allows an authenticated user with limited privileges to inject malicious HTML tags through remote strategies.

When a victim views the affected remote strategy in the Smart Polling functionality, the injected HTML renders in their browser. This can enable phishing attacks or open redirect attacks. However, full cross-site scripting (XSS) exploitation and direct information disclosure are prevented by existing input validation and Content Security Policy configurations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers with limited privileges to inject malicious HTML into remote strategies that other users view. When these users view the affected content, the malicious HTML can execute in their browsers, potentially leading to phishing attacks or open redirect attacks.

Although full XSS exploitation and direct information disclosure are prevented, the vulnerability still poses a medium risk and can compromise user trust and security.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the Stored HTML Injection vulnerability in the Smart Polling feature, users are advised to upgrade their Guardian and CMC software to version 26.1.0 or later.

As a workaround, users can review and remove any untrusted sensors to reduce the risk of malicious HTML injection.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the Stored HTML Injection vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0