This vulnerability arises from improper validation of input parameters in the Assets and Nodes features of Nozomi Networks Guardian. Specifically, an authenticated user with privileges to define custom fields can insert a JavaScript payload that is stored and later executed in the browsers of users viewing those pages. This stored XSS can lead to unauthorized actions performed with the victim's privileges within the application context.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, enabling unauthorized modification of application data, disruption of application availability, and access to sensitive information limited to the victim's privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict privileges to define custom fields to trusted users only and consider monitoring for suspicious activity related to custom fields.