EUVD-2025-209469
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionNVD
An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform administrative actions on it, altering the rules configuration, and/or affecting their availability.
AnalysisAI
Privilege escalation in Nozomi Networks Guardian and CMC Threat Intelligence module allows authenticated view-only users to perform administrative actions, including modifying or deleting threat intelligence rules. With CVSS 8.1 (High) driven by high integrity and availability impact, this access control bypass (CWE-863) enables low-privileged users to alter critical security configurations remotely. No public exploit identified at time of analysis, though EPSS data unavailable. Authentication requirements lower the barrier only slightly, as compromised low-privilege accounts are common in enterprise environments.
Technical ContextAI
This vulnerability affects the Threat Intelligence functionality in Nozomi Networks Guardian (industrial network security monitoring platform) and CMC (Central Management Console), identified by CPE strings cpe:2.3:a:nozomi_networks:guardian and cpe:2.3:a:nozomi_networks:cmc. The root cause is CWE-863 (Incorrect Authorization), a classic broken access control issue where role-based access control (RBAC) enforcement fails to properly validate user permissions before allowing state-changing operations. The application checks authentication (PR:L indicates low-privilege authenticated access required) but fails to verify authorization for administrative functions within the Threat Intelligence module. This represents a horizontal privilege escalation where users can exceed their designated view-only role to perform create/update/delete operations on threat intelligence rules, which are critical for network security posture and incident detection. The remote attack vector (AV:N) with low complexity (AC:L) indicates this is exploitable through standard network access to the web management interface without special conditions.
RemediationAI
Organizations running Nozomi Networks Guardian or CMC should immediately review the vendor security advisory at https://security.nozominetworks.com/NN-2026:1-01 for patched software versions and upgrade instructions. Upstream fix available (PR/commit); released patched version not independently confirmed from provided data sources. As an interim mitigation, review and restrict user account permissions in the Threat Intelligence module, ensuring view-only users cannot access administrative functions through UI or API. Audit existing threat intelligence rules for unauthorized modifications and implement additional monitoring for privilege escalation attempts. Consider isolating management interfaces to restricted networks and enforcing multi-factor authentication for all accounts with any level of Threat Intelligence access. Conduct an audit of all low-privilege account activity logs to identify potential historical exploitation prior to patch deployment.
Share
External POC / Exploit Code
Leaving vuln.today