Nozomi Guardian EUVD-2026-42536

Requires an authenticated account with limited privileges on a Nozomi Guardian/CMC deployment (PR:L) plus network access to the management/synchronization interface (AV:N); no user interaction and no non-default feature toggle is described - the flaw resides in the standard sync-to-Arc-sensor configuration path, and the specific prerequisite is that the account can invoke the synchronization functionality that pushes config to Arc sensors. Exploitation is limited by the need for valid credentials on the appliance and by network reachability of the management plane; it does not enable confidentiality breach (VC:N) and is bounded to integrity/availability of the device configuration and sensor uptime. It cannot be performed by a fully unauthenticated external attacker based on the CVSS vector.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H, base 7.2) indicates a network-reachable attack requiring only low privilege, no user interaction, and no special attack requirements, with high integrity and availability impact but no confidentiality impact. This is internally consistent with the description: an already-authenticated limited user escalates to administrative configuration control. Notably, the intelligence tags include 'Information Disclosure,' which conflicts with VC:N/SC:N in the CVSS vector and the description (which describes config alteration and availability loss, not data exposure) - treat the disclosure tag as unverified and likely mistagged. EPSS is not provided, KEV status is negative, and no POC is referenced, so real-world exploitation pressure appears low today; however, the low authentication bar and the fact that the target IS a security-monitoring control plane make this a meaningful priority for OT operators. Missing exact affected versions limits precise exposure scoping.

An attacker who holds a legitimate limited-privilege account on a Guardian/CMC deployment authenticates over the network and crafts administrative CLI commands, then triggers the synchronization function to push them to one or more Arc sensors. Because the sensors incorrectly accept CLI permissions from the sync, the commands execute administratively, letting the attacker rewrite sensor configuration or knock the sensor offline. No public exploit is currently identified, but the low complexity and low privilege requirement make hands-on-keyboard abuse straightforward for any insider or credential-holding adversary.