This vulnerability (CVE-2025-40904) in Nozomi Networks Guardian involves stored HTML injection due to insufficient input validation in the Smart Polling functionality. An authenticated user with limited privileges can push malicious HTML content via remote strategies synchronization. When viewed by other users, this content is rendered in their browsers, which may facilitate phishing or open redirect attacks. The existing input validation and Content Security Policy reduce the risk of full XSS exploitation and direct data leakage. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1. No patch or official remediation level has been provided by the vendor, and the product is not a cloud service, so remediation depends on vendor updates.

An attacker with limited authenticated access can inject malicious HTML that is stored and later rendered in other users' browsers. This can lead to phishing and open redirect attacks. However, the risk of full cross-site scripting exploitation and direct information disclosure is limited by existing input validation and Content Security Policy configurations. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the Smart Polling functionality to trusted users only and educating users about the risk of interacting with untrusted remote strategies.