This vulnerability arises from improper input validation in the Assets and Nodes features of Nozomi Networks Guardian, enabling stored cross-site scripting (CWE-79). An attacker with authenticated access and privileges to create custom fields can embed JavaScript payloads that execute in the context of other users viewing these pages. This can lead to unauthorized actions including modification of application data, disruption of service, and exposure of sensitive information. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack prerequisites, partial user interaction, and high impact on confidentiality and availability. The vendor has not provided a remediation level or patch information, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an authenticated attacker with custom fields privileges to execute arbitrary JavaScript in the browsers of users viewing the Assets or Nodes pages. This can result in unauthorized modification of application data, disruption of application availability, and access to sensitive information limited to the victim's privileges. The impact affects confidentiality, integrity, and availability of the application data and user sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict custom fields privileges to trusted users only and consider limiting access to the Assets and Nodes pages to reduce exposure. Monitor vendor communications for official patches or mitigations.