This vulnerability involves stored HTML injection in the Time Machine Snapshot Diff functionality of Nozomi Networks Guardian. An unauthenticated attacker can send specially crafted network packets at two different times to inject HTML tags into asset attributes across two snapshots. When a victim uses the Snapshot Diff feature on these snapshots and performs specific GUI actions, the injected HTML renders in their browser, potentially enabling phishing and open redirect attacks. Full XSS exploitation is prevented by existing input validation and Content Security Policy. The attack complexity is high, requiring multiple conditions to be met. No patch or official remediation guidance is currently available.

The vulnerability allows injection of HTML content that can be rendered in a victim's browser when using the Time Machine Snapshot Diff feature. This can facilitate phishing and open redirect attacks. However, the risk is limited by the high attack complexity, the need for user interaction, and partial mitigations such as input validation and Content Security Policy. There is no indication of full cross-site scripting exploitation or remote code execution. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when using the Time Machine Snapshot Diff feature, especially when viewing snapshots that might have been influenced by untrusted network traffic. No direct mitigation steps are provided by the vendor at this time.