This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Nozomi Networks Guardian. Specifically, the Reports feature does not adequately validate input parameters, allowing stored XSS attacks. An attacker with report privileges can embed JavaScript payloads in reports, which execute when viewed or imported by other users. The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, and requiring privileges and user interaction. The vulnerability impacts confidentiality, integrity, and availability at varying levels.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of victim users, leading to unauthorized modification of application data, disruption of application availability, and access to sensitive information limited to the victim's privileges. The attack requires an authenticated user with report privileges to create malicious content or social engineering to have victims import malicious report templates. There are no known exploits in the wild at this time.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict report creation privileges to trusted users only and educate users to avoid importing untrusted report templates. Monitor vendor communications for updates on remediation.