Nozomi Guardian CVE-2026-31983

The CVSS 4.0 vector (PR:N/AC:L/AT:N) confirms exploitation requires no authentication, no special attack complexity, and no attack prerequisites beyond network reachability to the SSH keys synchronization endpoint on Guardian or CMC. No user interaction is required. The primary limiting factor is network access: in well-segmented OT environments, Guardian and CMC management interfaces are typically restricted to dedicated management VLANs, which would prevent exploitation from untrusted network segments or the internet. The information disclosed is bounded to SSH public keys and user/group metadata - not private keys, passwords, or session tokens - limiting the direct weaponizability of the exposed data. All versions of both products appear affected based on wildcard CPE version specifiers.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) describes a trivially exploitable, zero-prerequisite network attack with limited confidentiality impact and no integrity or availability consequence - consistent with the 6.9 score. No EPSS data was included in available intelligence, and the vulnerability does not appear in CISA KEV, suggesting no confirmed active exploitation at time of analysis. No POC exploit code has been identified. The real-world risk is primarily reconnaissance: usernames, group memberships, and SSH public keys can be used to map the OT security team's user base, identify organizational hierarchy, and target individuals for social engineering or credential attacks. The absence of private key exposure and the typical network segmentation of OT management interfaces are meaningful mitigating factors. However, because Guardian and CMC are themselves security monitoring tools, compromise of information about their users carries elevated sensitivity in adversarial targeting of OT environments.

An attacker with network access to the Guardian or CMC management interface sends a single unauthenticated HTTP request to the SSH keys synchronization endpoint. The server returns a structured response containing usernames, group memberships, and SSH public keys for all users who have uploaded key material. The attacker uses this data to enumerate the security operations team, identify privileged accounts, and craft targeted phishing or credential-stuffing attacks against identified personnel.