This vulnerability (CVE-2025-40894) is a stored HTML injection issue classified under CWE-79 affecting Nozomi Networks Guardian. It occurs due to insufficient input validation on a node label parameter within the Alerted Nodes Dashboard functionality. An authenticated user with appropriate privileges can inject HTML code that may be rendered in other users' browsers when viewing alerts related to the compromised node. Although this can facilitate phishing or open redirect attacks, the system's existing input validation and Content Security Policy prevent full XSS exploitation and direct data leakage. The CVSS 4.0 base score is 2.1, indicating low severity. No patch or vendor advisory is currently available, and the product is not a cloud service.

The impact is limited to potential phishing and open redirect attacks via injected HTML rendered in victim users' browsers. Direct cross-site scripting exploitation and information disclosure are prevented by existing mitigations. The vulnerability requires an authenticated user with privileges to edit node labels, limiting the attack surface. There are no known exploits in the wild. Overall, the risk is low given the constraints and existing security controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should restrict privileges to edit node labels to trusted users only and consider monitoring for suspicious label changes. The existing input validation and Content Security Policy provide partial mitigation. No cloud service remediation applies as this is an on-premises product.