EUVD-2026-42534
GHSA-4jrp-wrhh-5622
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated request with no user interaction (AV:N/AC:L/PR:N/UI:N); only availability is affected via disk exhaustion (A:H), with no confidentiality or integrity impact and no scope change.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
2DescriptionCVE.org
A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable.
AnalysisAI
Disk-exhaustion denial of service in Nozomi Networks Guardian and Central Management Console (CMC) lets a remote, unauthenticated attacker fill available storage by sending requests with oversized input that the audit-logging subsystem records without any size limit. Because the affected devices are OT/ICS network-monitoring appliances, exhausting disk can render the sensor or its management console inoperable and blind defenders. No public exploit is identified at time of analysis; EPSS and KEV data were not provided, but the network/unauthenticated CVSS 4.0 profile (VA:H) makes this a low-effort attack.
Technical ContextAI
The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling). Guardian is Nozomi Networks' passive OT/IoT network-monitoring sensor and CMC (Central Management Console) is its multi-sensor aggregation platform (CPEs cpe:2.3:a:nozomi_networks:guardian and cpe:2.3:a:nozomi_networks:cmc, all versions per the wildcard). The audit-logging feature persists security-relevant events to disk; because it copies attacker-supplied input into each audit entry without enforcing a maximum size, the attacker controls how many bytes are written per request. Repeated or single large requests translate directly into unbounded disk writes - a classic resource-consumption flaw where a defensive logging mechanism becomes the amplification vector.
RemediationAI
Apply the fixed release identified in Nozomi Networks advisory NN-2026:11-01 (https://security.nozominetworks.com/NN-2026:11-01) - an exact patched version is not included in the provided data, so obtain it from that advisory (Patch available per vendor advisory). As compensating controls until patching, restrict network reachability of the Guardian/CMC management and API interfaces to trusted management networks or a jump host so untrusted sources cannot reach the endpoint feeding audit logging (trade-off: reduced remote accessibility). Additionally, place the audit log on a dedicated partition with disk quotas and enforce log rotation/size caps so exhaustion cannot down the whole system (trade-off: older audit records rotate out sooner), and alert on audit-volume disk utilization before it fills.
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in ce
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting
Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticat
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an auth
A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain
An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript cod
Privilege escalation via configuration synchronization in Nozomi Networks Guardian and Central Management Console (CMC)
Privilege escalation in Nozomi Networks Guardian and CMC Threat Intelligence module allows authenticated view-only users
Path traversal in Nozomi Networks CMC and Guardian allows authenticated users with limited privileges to write arbitrary
Stored Cross-Site Scripting (XSS) in Nozomi Networks Guardian and CMC allows authenticated attackers with custom field p
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today