A stored HTML injection flaw was identified in the Asset List component of Nozomi Networks' Guardian and CMC products. Input validation of network packet data fails to escape HTML characters, allowing an attacker to embed markup into asset attributes. When a victim views the affected assets in the Asset List or equivalent interfaces, the injected tags are rendered in the browser, enabling phishing or open‑redirect attacks. The description notes that full cross‑site scripting exploitation and direct information disclosure are mitigated by existing input checks and a Content Security Policy, but the ability to display arbitrary HTML remains a concern.

All deployed instances of Nozomi Networks' CMC and Guardian products with versions prior to 25.5.0 are affected. No specific sub‑versions are listed, so any release before the 25.5.0 update should be considered vulnerable.

The CVSS score of 5.3 indicates a moderate severity. An EPSS score of less than 1% suggests a very low probability of exploitation at this time, and the vulnerability is not included in CISA's KEV catalog. The likely attack vector involves an unauthenticated attacker sending crafted network packets to the device, inferred from the description. The attacker can inject HTML into asset attributes but cannot achieve full XSS or direct data exfiltration due to defensive input validation and CSP settings. Nonetheless, the rendered malicious content in the Asset List can be used for phishing or to drive users to malicious destinations when they interact with the UI.