This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Nozomi Networks Guardian. Specifically, an authenticated user with administrative privileges can inject HTML tags into a username. When a victim deletes a group containing the malicious user, the injected HTML executes in their browser, potentially enabling phishing and open redirect attacks. Existing input validation and Content Security Policy limit the impact by preventing full XSS exploitation and direct information disclosure. The vulnerability is classified as medium severity with a CVSS 4.8 score. No patch or official remediation level is currently documented, and the product is not a cloud service.

The vulnerability allows an authenticated administrator to inject HTML into usernames, which is rendered when deleting groups containing those users. This can lead to phishing and open redirect attacks against users performing group deletions. However, the impact is limited as full cross-site scripting exploitation and direct information disclosure are prevented by existing input validation and Content Security Policy. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, limit administrative user privileges to trusted personnel and exercise caution when deleting groups containing users with unusual usernames.