EUVD-2026-72788
GHSA-jx7f-4jrv-rjh9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low-privilege auth required; limited write/availability impact on discovery config only, no confidentiality loss, no scope change.
Primary rating from Vendor (nozominetworks).
CVSS VectorVendor: nozominetworks
Lifecycle Timeline
3DescriptionCVE.org
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network.
AnalysisAI
Broken access control in the Smart Polling configuration endpoint of Nozomi Networks' web management interface allows a low-privileged authenticated user to remotely modify discovery configuration that should be restricted to higher-privileged roles. The Smart Polling feature governs active network discovery of OT/ICS assets, so unauthorized modification can degrade or blind the platform's asset visibility - a significant operational impact in industrial security monitoring contexts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege authenticated session on the Nozomi Networks web management interface - the CVSS vector PR:L confirms this hard prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) reflects accurate calibration: network-accessible but requiring authentication (PR:L), with limited integrity and availability impact (VI:L/VA:L) and no confidentiality loss (VC:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Nozomi Networks security advisory NN-2026:17-01 at https://security.nozominetworks.com/NN-2026:17-01 for the patched version and upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today