EUVD-2026-42534
GHSA-4jrp-wrhh-5622
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Guardian/CMC network service
-
DeliverySubmit oversized input to audited endpoint
-
ExploitData written unbounded to audit log
-
ExecutionRepeat to exhaust disk space
-
ImpactAppliance inoperable, OT visibility lost
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network access to a Nozomi Guardian or CMC instance and the ability to submit input that flows into the audit-logging subsystem; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation against default configurations of Nozomi Guardian/CMC. The audit-logging functionality must be active, which is a standard, typically-enabled security feature. Limiting factors: the attacker must be able to reach the vulnerable network service, so appliances segmented onto isolated management-only networks are materially harder to hit, and impact is confined to availability (disk exhaustion) with no data disclosure or code execution. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, VC:N/VI:N) is internally consistent: remote, low-complexity, no privileges, no user interaction, availability-only impact with no confidentiality or integrity loss - base score 8.7. There is no KEV listing, no POC, and no EPSS value in the input, so exploitation probability cannot be quantified and the SSVC fields are unpopulated. The signals do not conflict - both vector and description indicate remote unauthenticated availability impact - so this is a genuine availability priority rather than an inflated score, but the lack of integrity/confidentiality impact means it is an outage risk, not a compromise. For OT monitoring appliances the operational cost of an outage (loss of network visibility) is elevated, which should raise its practical priority above a generic DoS. |
| Exploit ScenarioDerived | An attacker with network reach to a Guardian sensor or CMC console repeatedly sends requests containing very large payloads to an endpoint whose data is written into audit entries. With no size limit enforced, each request appends attacker-sized data to disk until the audit volume is exhausted and the appliance crashes or freezes, blinding OT network monitoring. No authentication, user interaction, or public exploit code is required, though none is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Disk-exhaustion denial of service in Nozomi Networks Guardian and Central Management Console (CMC) lets a remote, unauthenticated attacker fill available storage by sending requests with oversized input that the audit-logging subsystem records without any size limit. Because the affected devices are OT/ICS network-monitoring appliances, exhausting disk can render the sensor or its management console inoperable and blind defenders. No public exploit is identified at time of analysis; EPSS and KEV data were not provided, but the network/unauthenticated CVSS 4.0 profile (VA:H) makes this a low-effort attack.
RemediationAI
Apply the fixed release identified in Nozomi Networks advisory NN-2026:11-01 (https://security.nozominetworks.com/NN-2026:11-01) - an exact patched version is not included in the provided data, so obtain it from that advisory (Patch available per vendor advisory). As compensating controls until patching, restrict network reachability of the Guardian/CMC management and API interfaces to trusted management networks or a jump host so untrusted sources cannot reach the endpoint feeding audit logging (trade-off: reduced remote accessibility). Additionally, place the audit log on a dedicated partition with disk quotas and enforce log rotation/size caps so exhaustion cannot down the whole system (trade-off: older audit records rotate out sooner), and alert on audit-volume disk utilization before it fills.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling). Guardian is Nozomi Networks' passive OT/IoT network-monitoring sensor and CMC (Central Management Console) is its multi-sensor aggregation platform (CPEs cpe:2.3:a:nozomi_networks:guardian and cpe:2.3:a:nozomi_networks:cmc, all versions per the wildcard). The audit-logging feature persists security-relevant events to disk; because it copies attacker-supplied input into each audit entry without enforcing a maximum size, the attacker controls how many bytes are written per request. Repeated or single large requests translate directly into unbounded disk writes - a classic resource-consumption flaw where a defensive logging mechanism becomes the amplification vector.
Know when Cmc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated request with no user interaction (AV:N/AC:L/PR:N/UI:N); only availability is affected via disk exhaustion (A:H), with no confidentiality or integrity impact and no scope change.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
1DescriptionCVE.org
A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable.
Executive ViewAI
Nozomi Networks Guardian and Central Management Console (CMC) contain a high-severity denial-of-service vulnerability allowing unauthenticated remote attackers to exhaust storage via oversized audit-logging requests, rendering critical OT/ICS network monitoring infrastructure inoperable and eliminating security visibility. No public exploit identified at time of analysis; however, the trivial attack profile and complete impact on monitoring capability pose immediate organizational risk. No vendor-released patch identified at time of analysis, requiring urgent implementation of network-based compensating controls.
Firewall rules restricting network access to Guardian/CMC management interfaces (authorized administrator networks only); rate limiting on request processing if reverse proxy deployed; automated disk-usage monitoring with escalation at 70% and 85% thresholds; daily disk-space capacity audits; temporary deployment of redundant monitoring appliance for failover protection; enforce and validate audit-log retention policies to prevent uncontrolled growth.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in ce
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting
Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticat
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an auth
A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain
SQL injection in Nozomi Networks Guardian and CMC's Alert functionality allows an authenticated low-privilege user to ex
OS command injection in Nozomi Networks Guardian and CMC before 26.4.0 allows an attacker who already holds administrati
A signature-verification bypass in the update-installation functionality of Nozomi Networks Guardian and CMC before 26.4
An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript cod
Privilege escalation via configuration synchronization in Nozomi Networks Guardian and Central Management Console (CMC)
Exploit-DB