This vulnerability arises from insufficiently restrictive input validation in a shared function used by the Diagram tab and Graph view of Nozomi Networks Guardian. Authenticated users with administrative privileges can inject malicious HTML tags into N2OS configuration data via multiple input vectors. When other users view this data, the injected HTML is rendered in their browsers, enabling phishing and possibly open redirect attacks. However, the existing input validation and Content Security Policy limit the impact by preventing full cross-site scripting exploitation and direct information disclosure. No patch or remediation level has been provided at this time.

An attacker with administrative privileges can inject malicious HTML that is stored and rendered in the application interface for other users. This can facilitate phishing attacks and potentially open redirect attacks against users viewing the affected views. The vulnerability does not allow full cross-site scripting exploitation or direct information disclosure due to existing mitigations, reducing the overall impact severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity related to configuration data input. Review and strengthen input validation and Content Security Policy configurations if possible.