A stored cross‑site scripting flaw exists in the Reports feature of Nozomi Networks’ CMC and Guardian products. The flaw is caused by insufficient validation of an input parameter, allowing an attacker to embed arbitrary JavaScript into a report or report template. When a user views or imports the malicious report, the script runs in the victim’s browser context with the same privileges as the user, enabling the attacker to alter application data, disrupt availability, and access limited sensitive information.

All releases of Nozomi Networks CMC and Guardian prior to version 25.5.0 are affected. The vulnerability resides in the web‑based management interface that handles report creation and template import.

The CVSS score of 7.1 indicates a moderate‑to‑severe risk. The EPSS score of less than 1% shows that the likelihood of exploitation is low at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires either an authenticated user with report privileges or social engineering of a victim to import a malicious template. Because the attack affects only users with privileged access and needs a web browser, the attack vector is likely internal or target‑focused rather than widespread public exposure.