EUVD-2025-209469
GHSA-57pr-fgr5-wqvx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege credentials
-
DeliveryAuthenticate to Guardian/CMC web interface
-
ExploitAccess Threat Intelligence module
-
ExecutionBypass authorization check
-
PersistModify or delete threat rules
-
ImpactDegrade security monitoring
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Real-world risk is HIGH despite the low-privilege authentication requirement. The CVSS 8.1 score accurately reflects severe impact: High integrity (I:H) allows attackers to manipulate threat detection rules, potentially whitelisting malicious indicators or disabling critical detections; High availability (A:H) enables denial of security monitoring through rule deletion. Attack complexity is Low (AC:L) with no user interaction (UI:N), making exploitation straightforward once credentials are obtained. While PR:L requires authentication, low-privilege accounts are frequently compromised through phishing, credential stuffing, or insider threats in OT/ICS environments where Nozomi products operate. No public exploit identified at time of analysis reduces immediate tactical risk, but the simplicity of the attack (privilege escalation via web interface) means developing exploits requires minimal skill. The unchanged scope (S:U) limits lateral movement but does not diminish the direct impact on security operations. In SSVC terms: exploitation status is none confirmed, technical impact is total (security controls bypassed), automatable is yes (API-based attacks likely). This vulnerability should be prioritized for patching in operational technology environments where Nozomi Guardian provides critical visibility, as compromising threat intelligence undermines the entire security monitoring stack. |
| Exploit ScenarioDerived | An attacker compromises a help desk analyst's credentials with view-only access to the Nozomi Guardian Threat Intelligence dashboard through a targeted phishing campaign. Logging into the web management interface, the attacker navigates to the Threat Intelligence section and, exploiting the access control bypass, modifies critical detection rules to whitelist IP addresses associated with their command-and-control infrastructure. The attacker then deletes rules detecting lateral movement patterns, effectively blinding security operations to their ongoing industrial espionage campaign within the OT network. The manipulation goes unnoticed because view-only users are not expected to generate audit events for administrative actions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 15, 2026
Privilege escalation in Nozomi Networks Guardian and CMC Threat Intelligence module allows authenticated view-only users to perform administrative actions, including modifying or deleting threat intelligence rules. With CVSS 8.1 (High) driven by high integrity and availability impact, this access control bypass (CWE-863) enables low-privileged users to alter critical security configurations remotely. No public exploit identified at time of analysis, though EPSS data unavailable. Authentication requirements lower the barrier only slightly, as compromised low-privilege accounts are common in enterprise environments.
RemediationAI
Organizations running Nozomi Networks Guardian or CMC should immediately review the vendor security advisory at https://security.nozominetworks.com/NN-2026:1-01 for patched software versions and upgrade instructions. Upstream fix available (PR/commit); released patched version not independently confirmed from provided data sources. As an interim mitigation, review and restrict user account permissions in the Threat Intelligence module, ensuring view-only users cannot access administrative functions through UI or API. Audit existing threat intelligence rules for unauthorized modifications and implement additional monitoring for privilege escalation attempts. Consider isolating management interfaces to restricted networks and enforcing multi-factor authentication for all accounts with any level of Threat Intelligence access. Conduct an audit of all low-privilege account activity logs to identify potential historical exploitation prior to patch deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Threat Intelligence functionality in Nozomi Networks Guardian (industrial network security monitoring platform) and CMC (Central Management Console), identified by CPE strings cpe:2.3:a:nozomi_networks:guardian and cpe:2.3:a:nozomi_networks:cmc. The root cause is CWE-863 (Incorrect Authorization), a classic broken access control issue where role-based access control (RBAC) enforcement fails to properly validate user permissions before allowing state-changing operations. The application checks authentication (PR:L indicates low-privilege authenticated access required) but fails to verify authorization for administrative functions within the Threat Intelligence module. This represents a horizontal privilege escalation where users can exceed their designated view-only role to perform create/update/delete operations on threat intelligence rules, which are critical for network security posture and incident detection. The remote attack vector (AV:N) with low complexity (AC:L) indicates this is exploitable through standard network access to the web management interface without special conditions.
Know when Cmc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (Nozomi) · only source for this CVE.
CVSS VectorVendor: Nozomi
Lifecycle Timeline
5DescriptionCVE.org
An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform administrative actions on it, altering the rules configuration, and/or affecting their availability.
Executive ViewAI
CVE-2025-40897 affects Nozomi Networks Guardian and CMC Threat Intelligence module, allowing authenticated low-privilege users to escalate permissions and modify or delete critical threat intelligence rules, directly compromising the integrity of security controls. This access control bypass creates immediate risk to organizations relying on Guardian for threat detection and response, as compromised standard user accounts can now alter core security configurations without detection or authorization.
Apply vendor patch. Interim mitigations pending patch deployment: (1) restrict view-only account access to read-only API endpoints; (2) implement network segmentation to limit Guardian administrative interface access to trusted administrative subnets only; (3) enable and monitor all audit logs for threat intelligence rule modifications; (4) enforce multi-factor authentication for all administrative accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
Disk-exhaustion denial of service in Nozomi Networks Guardian and Central Management Console (CMC) lets a remote, unauth
A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in ce
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting
Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticat
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an auth
A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain
SQL injection in Nozomi Networks Guardian and CMC's Alert functionality allows an authenticated low-privilege user to ex
OS command injection in Nozomi Networks Guardian and CMC before 26.4.0 allows an attacker who already holds administrati
A signature-verification bypass in the update-installation functionality of Nozomi Networks Guardian and CMC before 26.4
An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript cod
Exploit-DB