Nozomi Networks Guardian and CMC Stored HTML Injection Vulnerability in Diagram Tab and Graph View

A stored HTML injection vulnerability has been identified in Nozomi Networks Guardian and CMC versions prior to 26.2.0. This vulnerability arises in the Diagram tab and Graph view, where a shared input validation function fails to adequately restrict user input. An authenticated user with administrative privileges can exploit this by injecting malicious HTML tags into N2OS configuration data through various input vectors. When the affected data is viewed in the Diagram tab and Graph view, the injected HTML is rendered in the browser, potentially leading to phishing attacks and open redirects. However, full exploitation of cross-site scripting and direct information disclosure is mitigated by existing input validation and Content Security Policy configurations.

Impact

Exploitation allows for stored HTML injection, with the injected HTML rendered in the victim's browser. This could facilitate phishing attacks and open redirects, although full cross-site scripting exploitation and direct information disclosure are blocked by current input validation and Content Security Policy settings.

Remediation

Users are advised to upgrade to version 26.2.0 or later. Additionally, internal firewall features can be used to restrict access to the web management interface, and it is recommended to review and remove unnecessary administrative accounts.