This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the Schedule Restore Archive functionality of Nozomi Networks Guardian. An authenticated user with administrative privileges can insert malicious HTML tags into restore schedules. When other users view these schedules, the injected HTML is rendered in their browsers, which can facilitate phishing and open redirect attacks. Existing input validation and Content Security Policy configurations limit the impact by preventing full XSS exploitation and direct information disclosure. No official fix or patch has been disclosed as of the publication date.

The vulnerability allows an authenticated administrator to inject HTML content that is rendered in other users' browsers when viewing restore schedules. This can lead to phishing attacks and open redirect scenarios. However, the risk of full cross-site scripting exploitation and direct information disclosure is mitigated by existing input validation and Content Security Policy. The overall impact is considered medium severity.

No official fix or patch is currently available for this vulnerability. Users should monitor vendor advisories for updates. Since the vulnerability requires administrative authentication and existing controls limit exploitation, immediate urgent remediation may not be necessary. Review and restrict administrative access as a precautionary measure until a patch is released.