EUVD-2026-42533
GHSA-jmhq-wjwf-9x96
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint with no special conditions; only limited confidentiality impact applies as no private keys, passwords, or session data are exposed.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
2DescriptionCVE.org
A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH keys.
AnalysisAI
Unauthenticated access to the SSH keys synchronization endpoint in Nozomi Networks Guardian and CMC exposes user enumeration data and SSH public keys to any network-reachable attacker. By sending a single unauthenticated request to this endpoint, an attacker can retrieve usernames, group memberships, and uploaded SSH public keys - providing meaningful reconnaissance into the OT security platform's user base. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; the CVSS 4.0 score of 6.9 reflects low confidentiality impact with no integrity or availability risk.
Technical ContextAI
Nozomi Networks Guardian is a flagship OT/ICS network visibility and security monitoring platform; CMC (Central Management Console) is the centralized management tier for orchestrating multiple Guardian sensors. Both products expose an SSH keys synchronization endpoint - a functional feature intended to distribute or replicate SSH public key material across the system - that is affected by CWE-306 (Missing Authentication for Critical Function). The CPE entries cpe:2.3:a:nozomi_networks:guardian:*:*:*:*:*:*:*:* and cpe:2.3:a:nozomi_networks:cmc:*:*:*:*:*:*:*:* use wildcards for all version fields, indicating the full version range has not been bounded in available intelligence. The root cause is the absence of any authentication gate on a network-facing API endpoint that returns sensitive organizational data.
RemediationAI
Consult the Nozomi Networks advisory at https://security.nozominetworks.com/NN-2026:10-01 and apply the vendor-released patch - exact fixed version numbers were not included in available intelligence and must be confirmed from the advisory. As a compensating control, restrict network access to the SSH keys synchronization endpoint using host-based firewall rules or perimeter controls, limiting reachability strictly to trusted management networks or known Guardian/CMC peer nodes. If SSH key synchronization is not actively used in the deployment, disable the endpoint entirely - note that doing so may interrupt automated SSH key distribution workflows and should be validated against operational requirements. In OT environments where Guardian and CMC management interfaces should already be isolated from untrusted segments, verify that existing network segmentation policies enforce this boundary.
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
Disk-exhaustion denial of service in Nozomi Networks Guardian and Central Management Console (CMC) lets a remote, unauth
A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in ce
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting
Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticat
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an auth
A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain
An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript cod
Privilege escalation via configuration synchronization in Nozomi Networks Guardian and Central Management Console (CMC)
Privilege escalation in Nozomi Networks Guardian and CMC Threat Intelligence module allows authenticated view-only users
Path traversal in Nozomi Networks CMC and Guardian allows authenticated users with limited privileges to write arbitrary
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today