A stored HTML injection flaw exists in the Alerted Nodes Dashboard of Nozomi Networks CMC and Guardian products. The flaw permits an authenticated user with sufficient privileges to edit a node label and embed arbitrary HTML into that label. When a victim user views the dashboard and a related alert is displayed, the injected HTML is rendered by the browser, enabling phishing attempts and possibly open redirect attacks. Full cross‑site scripting is mitigated by input validation and the system’s Content Security Policy, and direct information disclosure is prevented by existing controls.

Nozomi Networks CMC and Guardian users running any release earlier than v25.6.0 are affected. The vulnerability applies to any deployment that utilizes the Alerted Nodes Dashboard feature.

The CVSS score of 2.1 indicates low overall severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability requires an authenticated user with privilege to modify node labels and a system that displays alerts for the affected node. It is not currently listed in the CISA KEV catalog.