This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Nozomi Networks Guardian. Specifically, the Asset List functionality does not adequately validate network traffic data, allowing stored HTML injection. An unauthenticated attacker can send crafted network packets that embed HTML tags into asset attributes. When these assets are viewed, the injected HTML executes in the victim's browser, which can facilitate phishing or open redirect attacks. Despite this, the existing input validation and Content Security Policy limit the severity of exploitation, preventing full XSS and direct data leaks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and limited impact on confidentiality and integrity.

An attacker can inject HTML code into asset attributes viewed by users, potentially enabling phishing and open redirect attacks. However, the vulnerability does not allow full cross-site scripting exploitation or direct information disclosure due to existing mitigations. The impact is therefore limited to partial HTML injection with some risk of social engineering attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be aware of the risk of HTML injection in the Asset List functionality and consider limiting access or monitoring for suspicious network traffic. The existing input validation and Content Security Policy provide partial mitigation.