This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Nozomi Networks Guardian. Specifically, the Asset List feature does not adequately validate network traffic data, allowing an attacker without authentication to send crafted packets that inject HTML into asset attributes. When these assets are viewed, the injected HTML executes in the victim's browser, which can facilitate phishing and open redirect attacks. Existing input validation and Content Security Policy limit the impact by preventing full XSS exploitation and direct data disclosure.

An unauthenticated attacker can inject HTML content into asset attributes that render in users' browsers when viewing the Asset List. This can lead to phishing attacks and open redirect scenarios. However, the vulnerability does not allow full cross-site scripting exploitation or direct information disclosure due to existing mitigations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor Nozomi Networks advisories for updates. Existing input validation and Content Security Policy partially mitigate the risk.