This vulnerability involves stored HTML injection in the Alerted Nodes Dashboard of Nozomi Networks Guardian due to insufficient input validation on a node label parameter. An authenticated user with the required privileges can inject HTML tags that may be rendered in other users' browsers when viewing alerts related to the affected node. Although this could facilitate phishing and open redirect attacks, the risk of full XSS exploitation or direct data disclosure is mitigated by existing input validation and Content Security Policy. The CVSS 4.0 score is 2.1 (low severity), reflecting the limited impact and attack complexity.

A malicious authenticated user with privileges can inject HTML content into node labels, which may be rendered in the browsers of other users interacting with the Alerted Nodes Dashboard. This can enable phishing and open redirect attacks. However, the vulnerability does not allow full cross-site scripting exploitation or direct information disclosure due to existing input validation and Content Security Policy measures.

No patch or official fix information is provided for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict privileges to trusted users to minimize risk. The existing input validation and Content Security Policy reduce the impact, but monitoring for updates from Nozomi Networks is recommended.