This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Nozomi Networks Guardian. Specifically, an authenticated user with administrative privileges can inject stored HTML by creating a malicious user with HTML tags in the username. When another user attempts to delete a group containing this malicious user, the injected HTML is rendered in the victim's browser. While this enables phishing and possibly open redirect attacks, the existing input validation and Content Security Policy prevent full cross-site scripting exploitation and direct information disclosure.

The vulnerability allows an attacker with administrative access to inject HTML that executes in the context of other users performing group deletion actions. This can lead to phishing attacks and potentially open redirect scenarios. However, the risk of full XSS exploitation and direct information disclosure is limited by existing input validation and Content Security Policy controls. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit administrative access to trusted users only and monitor for suspicious activity involving user creation and group deletion. The existing input validation and Content Security Policy provide partial mitigation.