EUVD-2026-42536
GHSA-w68v-42v6-6q7h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable sync abusable by an authenticated limited user (PR:L, AC:L) with no confidentiality impact but full config-integrity and availability loss on the device.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
2DescriptionCVE.org
An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.
AnalysisAI
Privilege escalation via configuration synchronization in Nozomi Networks Guardian and Central Management Console (CMC) lets an authenticated low-privilege user push administrative CLI commands to managed Arc sensors, because those sensors incorrectly inherit CLI permissions during sync. Successful abuse alters device configuration and can degrade or disable sensor availability, undermining OT/ICS monitoring integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; risk is elevated by the network-reachable, low-privilege (PR:L) attack path against a security-critical appliance.
Technical ContextAI
The affected technology is Nozomi Networks' OT/IoT security monitoring stack - Guardian sensors and the CMC that aggregates and manages them - where Arc endpoint sensors receive configuration through a centralized synchronization channel. The root cause is CWE-266 (Incorrect Privilege Assignment): the sync mechanism grants Arc sensors CLI-level permissions that should be reserved for administrators, so commands propagated through sync execute with more authority than the initiating user holds. In practice this collapses the intended privilege boundary between a limited operator account and administrative CLI control of the sensor/appliance configuration. The affected CPEs are cpe:2.3:a:nozomi_networks:guardian and cpe:2.3:a:nozomi_networks:cmc (versions unspecified in the feed).
RemediationAI
Apply the fix described in Nozomi Networks advisory NN-2026:13-01 (https://security.nozominetworks.com/NN-2026:13-01); an exact patched version is not included in the provided data, so obtain the fixed build directly from that advisory before deployment. As compensating controls until patched: restrict which accounts can initiate configuration synchronization and tighten role assignments so limited-privilege users cannot push sync to Arc sensors; segment and firewall the management network so only trusted administrative hosts can reach the Guardian/CMC management interfaces (reducing the AV:N exposure), accepting that this constrains legitimate remote administration; and increase auditing/alerting on CLI-level configuration changes propagated through sync so unauthorized administrative commands are detected quickly. Avoid granting broad operator accounts on shared appliances where possible.
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
Disk-exhaustion denial of service in Nozomi Networks Guardian and Central Management Console (CMC) lets a remote, unauth
A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in ce
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting
Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticat
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an auth
A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain
An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript cod
Privilege escalation in Nozomi Networks Guardian and CMC Threat Intelligence module allows authenticated view-only users
Path traversal in Nozomi Networks CMC and Guardian allows authenticated users with limited privileges to write arbitrary
Stored Cross-Site Scripting (XSS) in Nozomi Networks Guardian and CMC allows authenticated attackers with custom field p
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today