# CVE-2025-40904: Nozomi Networks Guardian and CMC HTML injection in Smart Polling

Source: https://junglewise.ai/threats/cve-2025-40904-nozomi-networks-guardian-and-cmc-html-injection-in-smart-polling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2025-40904 · Severity: medium · CVSS 6.5 · Published 2026-05-19

Nozomi Networks Guardian and CMC appliances, which are used for industrial network monitoring and management, contain a security flaw in their Smart Polling feature. An attacker with low-level access can inject malicious HTML code into the system. If an administrator or another user views the affected page, they could be targeted with phishing content or redirected to malicious websites, potentially compromising their credentials or workstation.

Technologies: [Nozomi Networks Central Management Console](https://junglewise.ai/threats/technologies/central-management-console), [Nozomi Networks Guardian](https://junglewise.ai/threats/technologies/guardian). Vendors: [Nozomi Networks](https://junglewise.ai/threats/vendors/nozomi-networks).

## Quick answers

**Is CVE-2025-40904 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-40904 being exploited in the wild.

**How severe is CVE-2025-40904?** Medium severity, with a CVSS score of 6.5, published 19 May 2026.

**Which products and versions are affected?** Nozomi Networks Central Management Console < 26.1.0; Nozomi Networks Guardian < 26.1.0.

**Is there a fix for CVE-2025-40904?** A patch was published on 2026-05-19: Fixed in version 26.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-40904 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-40904?** Check whether you run Nozomi Networks Central Management Console or Nozomi Networks Guardian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored HTML injection vulnerability exists in the Smart Polling functionality of Nozomi Networks Guardian and CMC due to improper validation of input parameters. An authenticated attacker with limited privileges can push malicious remote strategies containing HTML tags through the synchronization process. When a victim views these strategies, the injected HTML is rendered in their browser. While existing input validation and Content Security Policy (CSP) configurations prevent full Cross-Site Scripting (XSS) and direct information disclosure, the flaw still allows for phishing and open redirect attacks. The issue is fixed in version 26.1.0.

## Affected products

- Nozomi Networks Guardian < 26.1.0
- Nozomi Networks Central Management Console (CMC) < 26.1.0

## Timeline

- 2026-05-19: disclosed: Initial discovery by Nozomi Networks internal security team.
- 2026-05-19: advisory
- 2026-05-19: patched: Fixed in version 26.1.0.

## References

- [https://security.nozominetworks.com/NN-2026:7-01](https://security.nozominetworks.com/NN-2026:7-01)

## Related threats

- [Nozomi Networks Guardian/CMC OS command injection in update installer](https://junglewise.ai/threats/cve-2026-33924-two-os-command-injection-vulnerabilities-were-discovered-in-the)
- [Nozomi Networks Guardian/CMC update signature bypass](https://junglewise.ai/threats/cve-2026-33923-a-signature-verification-vulnerability-was-discovered-in-the)
- [Nozomi Networks Guardian and CMC cross-site request forgery in login](https://junglewise.ai/threats/cve-2026-33920-nozomi-networks-guardian-and-cmc-cross-site-request-forgery-in)
- [Nozomi Guardian/CMC incorrect authorization in Smart Polling configuration](https://junglewise.ai/threats/cve-2026-33391-nozomi-guardian-cmc-incorrect-authorization-in-smart-polling)
- [Nozomi Networks Guardian/CMC and Arc improper certificate validation in Smart Polling](https://junglewise.ai/threats/cve-2026-33389-nozomi-networks-guardian-cmc-and-arc-improper-certificate)