EUVD-2026-42531
GHSA-5g4m-c643-h8fj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin privileges required (PR:H); victim must view affected page (UI:R); stored injection crosses user boundary (S:C); no availability impact; CSP blocks full exfiltration (C:L).
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
2DescriptionCVE.org
A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data through multiple input vectors. When a victim views the affected data in the Diagram tab and Graph view, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.
AnalysisAI
Stored HTML injection in Nozomi Networks Guardian and CMC (N2OS) allows authenticated administrators to embed malicious HTML into configuration data rendered in the Diagram tab and Graph view, enabling phishing and open redirect attacks against other authenticated users who view the affected pages. The vulnerability originates from a shared input validation function applied across multiple input vectors in N2OS that is insufficiently restrictive, permitting certain HTML tags to persist. Full XSS exploitation and direct information disclosure are explicitly constrained by existing input validation and a Content Security Policy, limiting realistic attacker impact to social engineering vectors. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
N2OS is Nozomi Networks' proprietary operating system underpinning both the Guardian (network visibility and security sensor) and CMC (Central Management Console, used for multi-site management) platforms - two of the core products in Nozomi's OT/ICS security stack. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting), specifically the stored variant, where attacker-controlled input persists server-side and is later rendered to victims' browsers. The root cause is a shared input validation function that sanitizes configuration data fields across the Diagram tab and Graph view UI components but does not strip or encode all HTML tags - allowing a subset of benign-looking HTML to pass through. The Content Security Policy in place blocks script execution and exfiltration, so the rendered HTML can affect layout and links (enabling phishing and open redirects) but cannot run arbitrary JavaScript or directly exfiltrate session tokens. Affected CPE strings: cpe:2.3:a:nozomi_networks:guardian:*:*:*:*:*:*:*:* and cpe:2.3:a:nozomi_networks:cmc:*:*:*:*:*:*:*:* (all versions per NVD CPE, specific fix version not confirmed).
RemediationAI
Consult the Nozomi Networks security advisory at https://security.nozominetworks.com/NN-2026:8-01 for the vendor-released patch and exact fixed version, as the provided CPE data uses wildcard version ranges and a specific patched release is not independently confirmed from the available input. The root fix should involve hardening the shared input validation function to apply strict allowlisting of permitted characters or HTML entities in configuration data fields feeding the Diagram tab and Graph view. As a compensating control pending patching, administrators can restrict Guardian and CMC access to the minimum number of trusted administrative accounts, reducing the pool of potential injectors and limiting opportunity for intra-admin misuse. Additionally, enforcing network-level access controls (e.g., restricting CMC and Guardian web UI access to dedicated management VLANs) reduces exposure to opportunistic attackers. Note that the existing CSP already mitigates the worst-case XSS scenarios; the residual risk is limited to phishing and open redirect, so defenders should evaluate whether the environment's threat model makes this a high-urgency patch even before a fix is applied.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today