This vulnerability arises from improper input validation in the custom fields feature of Nozomi Networks Guardian, leading to stored XSS. Authenticated users with custom field privileges can embed JavaScript payloads that execute in the context of other users viewing the affected pages. This can result in unauthorized actions including data manipulation, service disruption, and exposure of sensitive data. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack prerequisites, partial user interaction, and high impact on integrity and availability. No patch or official remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation allows an attacker with limited privileges to execute arbitrary JavaScript in the browsers of other users who view the compromised pages. This can lead to unauthorized modification of application data, disruption of application availability, and unauthorized access to sensitive information within the application context. The vulnerability is rated high severity with a CVSS score of 7.1, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or closely monitor users with privileges to create or modify custom fields to reduce risk. Consider implementing additional input validation or output encoding controls if possible. Avoid viewing or interacting with the affected Assets and Nodes pages from untrusted accounts. Follow updates from Nozomi Networks for official patches or mitigations.