CVE-2025-40904 Nozomi Networks CVE debrief

Who should care

Administrators and security teams running Nozomi Networks CMC or Guardian, especially environments that use Smart Polling or accept strategy sync content from multiple authenticated users. SOC and incident response teams should also care because the issue can be abused for phishing-like browser manipulation.

Technical summary

The vulnerability is a stored HTML injection caused by improper validation of an input parameter in Smart Polling. A low-privilege authenticated attacker can push remote strategy content containing HTML through the sync flow. When a victim views that content, the browser renders the injected HTML. The supplied record identifies CWE-79 and states that validation plus CSP reduce the likelihood of full script execution and direct data disclosure. NVD lists affected CPEs for Nozomi Networks CMC and Guardian with vulnerability coverage ending before 26.1.0.

Defensive priority

Medium priority. The issue requires authenticated access and user interaction, but it can still be used to mislead users or stage phishing and redirect abuse. Prioritize remediation if the affected products are exposed to broader internal user bases or untrusted authenticated accounts.

Recommended defensive actions

• Check whether Nozomi Networks CMC or Guardian deployments are on versions earlier than 26.1.0.
• Review which authenticated users can sync or submit remote strategies in Smart Polling and restrict that capability to trusted roles.
• Apply vendor remediation guidance and upgrade to a fixed release when available.
• Inspect strategy content and browser-rendered fields for unexpected HTML, phishing cues, or redirect behavior.
• Ensure data shown in Smart Polling is safely validated and encoded wherever custom integrations or local controls are in place.

Evidence notes

The debrief is based only on the supplied NVD record and the vendor advisory reference it cites. The source text explicitly describes stored HTML injection in Smart Polling, limited-privilege authenticated abuse, phishing/open-redirect risk, and mitigations from input validation plus CSP. NVD metadata provides the affected CPEs, version boundary before 26.1.0, CVSS 4.0 vector, and CWE-79 mapping. The vendor advisory URL is referenced in NVD, but its full text was not included in the corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.