Nozomi Networks Guardian EUVD-2026-42532

SAML Single Sign-On must be configured and enabled on the Guardian or CMC deployment. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N) confirms that exploitation requires no authentication, no special attacker privileges, and no non-default configuration on the attacker's side. Exploitation is bounded by UI:P: victim users must actively initiate a SAML SSO login session after the attacker has poisoned the redirect cache, meaning the attack window depends on the cache lifetime and the frequency of user logins. Deployments that do not use SAML SSO - relying instead on local authentication or other identity mechanisms - are not affected by this vulnerability. The cache-poisoning design means the attacker's single crafted request can affect all subsequent SSO users, not just a single targeted individual.

The CVSS 4.0 score of 5.3 (Medium) uses AV:N/AC:L/AT:N/PR:N/UI:P, reflecting unauthenticated network access with no special conditions and passive victim interaction required. Impact metrics (VI:L/VA:L/SC:L/SI:L/SA:L) indicate limited but non-trivial effects on both the vulnerable system and downstream systems - the subsequent-system metrics capture the multi-victim nature of the cache poisoning. The UI:P requirement (victim must initiate an SSO login) is a realistic bound, not a strong mitigator, as SAML SSO is typically the default login path for enterprise deployments. The cache-poisoning characteristic meaningfully amplifies real-world impact: a single unauthenticated request can affect all users who authenticate via SAML until the cache is cleared, rather than targeting only one victim at a time. No EPSS data, CISA KEV listing, or public proof-of-concept code has been identified, suggesting no known active exploitation. However, organizations using Guardian or CMC for OT/ICS visibility should treat this as a meaningful phishing and credential-theft risk given the sensitivity of the access these products control. The moderate CVSS score somewhat underweights the multi-victim cascade potential.

An unauthenticated external attacker identifies a Nozomi Networks Guardian or CMC instance with SAML SSO enabled and sends a crafted HTTP request to the SAML authentication endpoint, injecting a redirect URL pointing to an attacker-controlled phishing page designed to mimic the Guardian or CMC login interface. The malicious redirect is accepted and cached server-side; when legitimate users subsequently click 'Sign in with SSO,' they are silently forwarded to the phishing page rather than their intended destination, where their credentials are harvested. No public POC code has been identified at time of analysis.