CVE-2025-40904
Stored HTML Injection in Smart Polling Feature
Publication date: 2026-05-19
Last updated on: 2026-05-19
Assigner: Nozomi Networks Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nozominetworks | cmc | to 26.1.0 (exc) |
| nozominetworks | guardian | to 26.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-40904 is a Stored HTML Injection vulnerability found in the Smart Polling feature of Guardian and CMC software versions before 26.1.0. It occurs because of improper validation of an input parameter, which allows an authenticated user with limited privileges to inject malicious HTML tags through remote strategies.
When a victim views the affected remote strategy in the Smart Polling functionality, the injected HTML renders in their browser. This can enable phishing attacks or open redirect attacks. However, full cross-site scripting (XSS) exploitation and direct information disclosure are prevented by existing input validation and Content Security Policy configurations.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers with limited privileges to inject malicious HTML into remote strategies that other users view. When these users view the affected content, the malicious HTML can execute in their browsers, potentially leading to phishing attacks or open redirect attacks.
Although full XSS exploitation and direct information disclosure are prevented, the vulnerability still poses a medium risk and can compromise user trust and security.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the Stored HTML Injection vulnerability in the Smart Polling feature, users are advised to upgrade their Guardian and CMC software to version 26.1.0 or later.
As a workaround, users can review and remove any untrusted sensors to reduce the risk of malicious HTML injection.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the Stored HTML Injection vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.