Nozomi Guardian CMC CVE-2025-3719

Exploitation requires the attacker to already possess a valid but limited-privilege account on a Nozomi Networks Guardian or CMC appliance and network reachability to its CLI interface; the flaw is that a specific access restriction on administrative CLI commands is not enforced for such accounts. Limiting factors: this is not remote-unauthenticated - a low-privilege credential (PR:L) is mandatory, there is no confidentiality impact (data is not directly read), and impact is confined to the appliance itself (no scope change, SC/SI/SA:N). Realistic risk is driven by insider misuse or post-compromise privilege escalation rather than anonymous internet attack.

This is a credible but not emergency-tier priority. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only a low-privileged authenticated account, with high impact to integrity (VI:H) and availability (VA:H) but no confidentiality impact (VC:N) and no scope change. CWE-863 (Incorrect Authorization) and the description confirm this is an authorization/privilege-escalation issue in the CLI, not a true authentication bypass - the attacker must already hold valid limited-privilege credentials. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active or imminent mass exploitation; the realistic threat is an insider or an attacker who has already obtained a low-privilege foothold escalating to administrative control. The SSVC/exploitation signals are therefore weighted toward 'needs patching in normal cycle' rather than 'exploit now.' Note a tagging discrepancy: the 'Authentication Bypass' tag conflicts with the description and CWE-863, which point to authorization bypass/privilege escalation - verify framing with the vendor advisory.

An attacker who already holds a low-privilege account on a Nozomi Networks Guardian or CMC appliance (e.g. a limited operator login or compromised read-only credential) connects to the CLI and issues administrative commands that the privilege check fails to block. They alter the device configuration or disrupt availability of the OT/ICS monitoring sensor. No public exploit identified at time of analysis; exploitation requires only valid limited credentials and standard CLI access.