# Recent vulnerabilities from CSAF Nozomi Networks ## [nn-2026:20-01](https://vulnerability.circl.lu/vuln/nn-2026%3A20-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "High", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0", "tracking": { "aliases": [ "CVE-2026-33389" ], "current_release_date": "2026-09-08T11:00:00.000Z", "id": "NN-2026:20-01", "initial_release_date": "2026-09-08T11:00:00.000Z", "revision_history": [ { "date": "2026-09-08T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.3.0", "product": { "name": "Nozomi Networks Guardian <26.3.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.3.0", "product": { "name": "Nozomi Networks Guardian 26.3.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.3.0", "product": { "name": "Nozomi Networks CMC <26.3.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.3.0", "product": { "name": "Nozomi Networks CMC 26.3.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<2.7.0", "product": { "name": "Nozomi Networks Arc <2.7.0", "product_id": "CSAFPID-0005" } }, { "category": "product_version", "name": "2.7.0", "product": { "name": "Nozomi Networks Arc 2.7.0", "product_id": "CSAFPID-0006" } } ], "category": "product_name", "name": "Arc" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Balzarotti" ], "organization": "Nozomi Networks", "summary": "finding this issue during an internal investigation" }, { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-33389", "cwe": { "id": "CWE-671", "name": "Lack of Administrator Control over Security" }, "discovery_date": "2026-09-08T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:20-01" } ], "notes": [ { "category": "summary", "text": "An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004", "CSAFPID-0006" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003", "CSAFPID-0005" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33389" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_20-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:20-01" } ], "remediations": [ { "category": "mitigation", "details": "N/A", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003", "CSAFPID-0005" ] }, { "category": "vendor_fix", "details": "Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003", "CSAFPID-0005" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003", "CSAFPID-0005" ] } ], "threats": [ { "category": "impact", "details": "A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations." } ], "title": "Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0" } ] } ``` ## [nn-2026:19-01](https://vulnerability.circl.lu/vuln/nn-2026%3A19-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "High", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0", "tracking": { "aliases": [ "CVE-2026-33388" ], "current_release_date": "2026-09-08T11:00:00.000Z", "id": "NN-2026:19-01", "initial_release_date": "2026-09-08T11:00:00.000Z", "revision_history": [ { "date": "2026-09-08T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.3.0", "product": { "name": "Nozomi Networks Guardian <26.3.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.3.0", "product": { "name": "Nozomi Networks Guardian 26.3.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.3.0", "product": { "name": "Nozomi Networks CMC <26.3.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.3.0", "product": { "name": "Nozomi Networks CMC 26.3.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Elia Battiston" ], "organization": "Nozomi Networks", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-33388", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2026-09-08T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:19-01" } ], "notes": [ { "category": "summary", "text": "An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33388" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_19-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:19-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones. Review the existing entries in the Credentials Manager for unauthorized modifications.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.3.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials." } ], "title": "Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0" } ] } ``` ## [nn-2026:18-01](https://vulnerability.circl.lu/vuln/nn-2026%3A18-01) ```json { "document": { "aggregate_severity": { "text": "LOW" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Cross-site request forgery in the Guardian/CMC login before 26.3.0", "tracking": { "aliases": [ "CVE-2026-33920" ], "current_release_date": "2026-09-08T11:00:00.000Z", "id": "NN-2026:18-01", "initial_release_date": "2026-09-08T11:00:00.000Z", "revision_history": [ { "date": "2026-09-08T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.3.0", "product": { "name": "Nozomi Networks Guardian <26.3.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.3.0", "product": { "name": "Nozomi Networks Guardian 26.3.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.3.0", "product": { "name": "Nozomi Networks CMC <26.3.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.3.0", "product": { "name": "Nozomi Networks CMC 26.3.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "organization": "one of our customers", "summary": "finding this issue during a VAPT testing session" } ], "cve": "CVE-2026-33920", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2026-09-08T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:18-01" } ], "notes": [ { "category": "summary", "text": "A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33920" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_18-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:18-01" } ], "remediations": [ { "category": "mitigation", "details": "Users should always pay attention to phishing emails and untrusted links.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.3.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail." } ], "title": "Cross-site request forgery in the Guardian/CMC login before 26.3.0" } ] } ``` ## [nn-2026:17-01](https://vulnerability.circl.lu/vuln/nn-2026%3A17-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0", "tracking": { "aliases": [ "CVE-2026-33391" ], "current_release_date": "2026-09-08T11:00:00.000Z", "id": "NN-2026:17-01", "initial_release_date": "2026-09-08T11:00:00.000Z", "revision_history": [ { "date": "2026-09-08T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.3.0", "product": { "name": "Nozomi Networks Guardian <26.3.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.3.0", "product": { "name": "Nozomi Networks Guardian 26.3.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.3.0", "product": { "name": "Nozomi Networks CMC <26.3.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.3.0", "product": { "name": "Nozomi Networks CMC 26.3.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "organization": "one of our customers", "summary": "finding this issue during a VAPT testing session" } ], "cve": "CVE-2026-33391", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2026-09-08T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:17-01" } ], "notes": [ { "category": "summary", "text": "An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33391" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_17-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:17-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones. Review your Smart Polling discovery configuration.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.3.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network." } ], "title": "Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0" } ] } ``` ## [nn-2026:16-01](https://vulnerability.circl.lu/vuln/nn-2026%3A16-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0", "tracking": { "aliases": [ "CVE-2026-33387" ], "current_release_date": "2026-09-08T11:00:00.000Z", "id": "NN-2026:16-01", "initial_release_date": "2026-09-08T11:00:00.000Z", "revision_history": [ { "date": "2026-09-08T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.3.0", "product": { "name": "Nozomi Networks Guardian <26.3.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.3.0", "product": { "name": "Nozomi Networks Guardian 26.3.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.3.0", "product": { "name": "Nozomi Networks CMC <26.3.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.3.0", "product": { "name": "Nozomi Networks CMC 26.3.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-33387", "cwe": { "id": "CWE-1336", "name": "Improper Neutralization of Special Elements Used in a Template Engine" }, "discovery_date": "2026-09-08T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:16-01" } ], "notes": [ { "category": "summary", "text": "A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33387" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_16-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:16-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones. Additionally, review existing dashboards for malicious content.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.3.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability." } ], "title": "Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0" } ] } ``` ## [nn-2026:15-01](https://vulnerability.circl.lu/vuln/nn-2026%3A15-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0", "tracking": { "aliases": [ "CVE-2026-33922" ], "current_release_date": "2026-08-11T11:00:00.000Z", "id": "NN-2026:15-01", "initial_release_date": "2026-08-11T11:00:00.000Z", "revision_history": [ { "date": "2026-08-11T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<2.7.0", "product": { "name": "Nozomi Networks Arc <2.7.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "2.7.0", "product": { "name": "Nozomi Networks Arc 2.7.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Arc" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-33922", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2026-08-11T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:15-01" } ], "notes": [ { "category": "summary", "text": "A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002" ], "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33922" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_15-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:15-01" } ], "remediations": [ { "category": "mitigation", "details": "Review the credentials of the web interface and rotate them by relaunching Arc's local web server if they may have been exposed to untrusted users.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "vendor_fix", "details": "Upgrade Arc to v2.7.0 or later.", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "threats": [ { "category": "impact", "details": "A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host." } ], "title": "Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0" } ] } ``` ## [nn-2026:14-01](https://vulnerability.circl.lu/vuln/nn-2026%3A14-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0", "tracking": { "aliases": [ "CVE-2026-33921" ], "current_release_date": "2026-08-11T11:00:00.000Z", "id": "NN-2026:14-01", "initial_release_date": "2026-08-11T11:00:00.000Z", "revision_history": [ { "date": "2026-08-11T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<2.7.0", "product": { "name": "Nozomi Networks Arc <2.7.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "2.7.0", "product": { "name": "Nozomi Networks Arc 2.7.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Arc" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Balzarotti" ], "organization": "Nozomi Networks", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-33921", "cwe": { "id": "CWE-1188", "name": "Initialization of a Resource with an Insecure Default" }, "discovery_date": "2026-08-11T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:14-01" } ], "notes": [ { "category": "summary", "text": "The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002" ], "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33921" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_14-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:14-01" } ], "remediations": [ { "category": "mitigation", "details": "Reinstall Npcap on the affected host with the \"Restrict Npcap driver's access to Administrators only\" option enabled.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "vendor_fix", "details": "Upgrade Arc to v2.7.0 or later.", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "threats": [ { "category": "impact", "details": "A local user without administrative privileges could use the Npcap driver to capture the traffic reaching the host, which discloses information belonging both to the host and to other systems on the same network segment, and to send arbitrary raw packets on that segment." } ], "title": "Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0" } ] } ``` ## [nn-2026:9-01](https://vulnerability.circl.lu/vuln/nn-2026%3A9-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0", "tracking": { "aliases": [ "CVE-2026-31982" ], "current_release_date": "2026-07-07T11:00:00.000Z", "id": "NN-2026:9-01", "initial_release_date": "2026-07-07T11:00:00.000Z", "revision_history": [ { "date": "2026-07-07T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks Guardian <26.2.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks Guardian 26.2.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks CMC <26.2.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks CMC 26.2.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-31982", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site ('Open Redirect')" }, "discovery_date": "2026-07-07T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:9-01" } ], "notes": [ { "category": "summary", "text": "An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31982" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_9-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:9-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.2.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for all affected users." } ], "title": "Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0" } ] } ``` ## [nn-2026:8-01](https://vulnerability.circl.lu/vuln/nn-2026%3A8-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Low", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0", "tracking": { "aliases": [ "CVE-2026-31981" ], "current_release_date": "2026-07-07T11:00:00.000Z", "id": "NN-2026:8-01", "initial_release_date": "2026-07-07T11:00:00.000Z", "revision_history": [ { "date": "2026-07-07T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks Guardian <26.2.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks Guardian 26.2.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks CMC <26.2.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks CMC 26.2.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero", "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-31981", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-07-07T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:8-01" } ], "notes": [ { "category": "summary", "text": "A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31981" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_8-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:8-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with administrative access to it and delete unnecessary ones.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.2.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data through multiple input vectors. When a victim views the affected data in the Diagram tab and Graph view, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration." } ], "title": "HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0" } ] } ``` ## [nn-2026:13-01](https://vulnerability.circl.lu/vuln/nn-2026%3A13-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "High", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0", "tracking": { "aliases": [ "CVE-2026-33390" ], "current_release_date": "2026-07-07T11:00:00.000Z", "id": "NN-2026:13-01", "initial_release_date": "2026-07-07T11:00:00.000Z", "revision_history": [ { "date": "2026-07-07T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks Guardian <26.2.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks Guardian 26.2.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks CMC <26.2.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks CMC 26.2.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-33390", "cwe": { "id": "CWE-266", "name": "Incorrect Privilege Assignment" }, "discovery_date": "2026-07-07T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:13-01" } ], "notes": [ { "category": "summary", "text": "An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33390" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_13-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:13-01" } ], "remediations": [ { "category": "mitigation", "details": "Review all enabled sensors and disallow or delete untrusted ones.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.2.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability." } ], "title": "Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0" } ] } ``` ## [nn-2026:12-01](https://vulnerability.circl.lu/vuln/nn-2026%3A12-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "High", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.0", "tracking": { "aliases": [ "CVE-2026-31985" ], "current_release_date": "2026-07-07T11:00:00.000Z", "id": "NN-2026:12-01", "initial_release_date": "2026-07-07T11:00:00.000Z", "revision_history": [ { "date": "2026-07-07T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks Remote Collector <26.2.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks Remote Collector 26.2.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Remote Collector" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-31985", "cwe": { "id": "CWE-671", "name": "Lack of Administrator Control over Security" }, "discovery_date": "2026-07-07T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:12-01" } ], "notes": [ { "category": "summary", "text": "When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and no option was provided to enable it.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002" ], "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31985" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_12-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:12-01" } ], "remediations": [ { "category": "mitigation", "details": "Manually edit the \"n2os.conf.user\" file in the Remote Collector and remove the \"!\" prefix from the upstream Guardian or CMC endpoint entry to enable TLS certificate verification.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "vendor_fix", "details": "Upgrade Remote Collector to v26.2.0 or later.", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "threats": [ { "category": "impact", "details": "A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Remote Collector and the Guardian or CMC. This could result in theft of the sync token, impersonation of the server, injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC, or disruption of the data flow between the Remote Collector and the Guardian or CMC." } ], "title": "Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.0" } ] } ``` ## [nn-2026:11-01](https://vulnerability.circl.lu/vuln/nn-2026%3A11-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "High", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "DoS through oversized audit log entries in Guardian/CMC before 26.2.0", "tracking": { "aliases": [ "CVE-2026-31984" ], "current_release_date": "2026-07-07T11:00:00.000Z", "id": "NN-2026:11-01", "initial_release_date": "2026-07-07T11:00:00.000Z", "revision_history": [ { "date": "2026-07-07T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks Guardian <26.2.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks Guardian 26.2.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks CMC <26.2.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks CMC 26.2.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-31984", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-07-07T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:11-01" } ], "notes": [ { "category": "summary", "text": "A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31984" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_11-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:11-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.2.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable." } ], "title": "DoS through oversized audit log entries in Guardian/CMC before 26.2.0" } ] } ``` ## [nn-2026:10-01](https://vulnerability.circl.lu/vuln/nn-2026%3A10-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0", "tracking": { "aliases": [ "CVE-2026-31983" ], "current_release_date": "2026-07-07T11:00:00.000Z", "id": "NN-2026:10-01", "initial_release_date": "2026-07-07T11:00:00.000Z", "revision_history": [ { "date": "2026-07-07T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks Guardian <26.2.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks Guardian 26.2.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.2.0", "product": { "name": "Nozomi Networks CMC <26.2.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.2.0", "product": { "name": "Nozomi Networks CMC 26.2.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2026-31983", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "discovery_date": "2026-07-07T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:10-01" } ], "notes": [ { "category": "summary", "text": "A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31983" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_10-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:10-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.2.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH keys." } ], "title": "Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0" } ] } ``` ## [nn-2026:7-01](https://vulnerability.circl.lu/vuln/nn-2026%3A7-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "HTML injection in Smart Polling in Guardian/CMC before 26.1.0", "tracking": { "aliases": [ "CVE-2025-40904" ], "current_release_date": "2026-05-19T11:00:00.000Z", "id": "NN-2026:7-01", "initial_release_date": "2026-05-19T11:00:00.000Z", "revision_history": [ { "date": "2026-05-19T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.1.0", "product": { "name": "Nozomi Networks Guardian <26.1.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.1.0", "product": { "name": "Nozomi Networks Guardian 26.1.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.1.0", "product": { "name": "Nozomi Networks CMC <26.1.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.1.0", "product": { "name": "Nozomi Networks CMC 26.1.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero", "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40904", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-05-19T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:7-01" } ], "notes": [ { "category": "summary", "text": "A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40904" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_7-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:7-01" } ], "remediations": [ { "category": "mitigation", "details": "Review all enabled sensors and disallow or delete untrusted ones.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.1.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with limited privileges can push malicious remote strategies containing HTML tags through the sync. When a victim views the affected remote strategy in the Smart Polling functionality, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration." } ], "title": "HTML injection in Smart Polling in Guardian/CMC before 26.1.0" } ] } ``` ## [nn-2026:6-01](https://vulnerability.circl.lu/vuln/nn-2026%3A6-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Low", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0", "tracking": { "aliases": [ "CVE-2025-40903" ], "current_release_date": "2026-05-19T11:00:00.000Z", "id": "NN-2026:6-01", "initial_release_date": "2026-05-19T11:00:00.000Z", "revision_history": [ { "date": "2026-05-19T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.1.0", "product": { "name": "Nozomi Networks Guardian <26.1.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.1.0", "product": { "name": "Nozomi Networks Guardian 26.1.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.1.0", "product": { "name": "Nozomi Networks CMC <26.1.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.1.0", "product": { "name": "Nozomi Networks CMC 26.1.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero", "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40903", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-05-19T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:6-01" } ], "notes": [ { "category": "summary", "text": "A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40903" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_6-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:6-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with administrative access to it and delete unnecessary ones.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.1.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with administrative privileges can define a malicious restore schedule containing HTML tags. When a victim views the affected schedule, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration." } ], "title": "HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0" } ] } ``` ## [nn-2026:5-01](https://vulnerability.circl.lu/vuln/nn-2026%3A5-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Low", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "HTML injection in Users in Guardian/CMC before 26.1.0", "tracking": { "aliases": [ "CVE-2025-40902" ], "current_release_date": "2026-05-19T11:00:00.000Z", "id": "NN-2026:5-01", "initial_release_date": "2026-05-19T11:00:00.000Z", "revision_history": [ { "date": "2026-05-19T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.1.0", "product": { "name": "Nozomi Networks Guardian <26.1.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.1.0", "product": { "name": "Nozomi Networks Guardian 26.1.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.1.0", "product": { "name": "Nozomi Networks CMC <26.1.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.1.0", "product": { "name": "Nozomi Networks CMC 26.1.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero", "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40902", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-05-19T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:5-01" } ], "notes": [ { "category": "summary", "text": "A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40902" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_5-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:5-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with administrative access to it and delete unnecessary ones. Review usernames of existing users.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.1.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with administrative privileges can create a malicious user whose username contains HTML tags. When a victim attempts to delete a group containing the affected user, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration." } ], "title": "HTML injection in Users in Guardian/CMC before 26.1.0" } ] } ``` ## [nn-2026:4-01](https://vulnerability.circl.lu/vuln/nn-2026%3A4-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Low", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "HTML injection in Credentials Manager in Guardian/CMC before 26.1.0", "tracking": { "aliases": [ "CVE-2025-40901" ], "current_release_date": "2026-05-19T11:00:00.000Z", "id": "NN-2026:4-01", "initial_release_date": "2026-05-19T11:00:00.000Z", "revision_history": [ { "date": "2026-05-19T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.1.0", "product": { "name": "Nozomi Networks Guardian <26.1.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.1.0", "product": { "name": "Nozomi Networks Guardian 26.1.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.1.0", "product": { "name": "Nozomi Networks CMC <26.1.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.1.0", "product": { "name": "Nozomi Networks CMC 26.1.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero", "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40901", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-05-19T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:4-01" } ], "notes": [ { "category": "summary", "text": "A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40901" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_4-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:4-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with administrative access to it and delete unnecessary ones. Review existing identities stored in the Credentials Manager.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.1.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with administrative privileges can define a malicious identity containing HTML tags. When a victim attempts to delete the affected identity, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration." } ], "title": "HTML injection in Credentials Manager in Guardian/CMC before 26.1.0" } ] } ``` ## [nn-2026:3-01](https://vulnerability.circl.lu/vuln/nn-2026%3A3-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Angular template injection in Reports in Guardian/CMC before 26.1.0", "tracking": { "aliases": [ "CVE-2025-40900" ], "current_release_date": "2026-05-19T11:00:00.000Z", "id": "NN-2026:3-01", "initial_release_date": "2026-05-19T11:00:00.000Z", "revision_history": [ { "date": "2026-05-19T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.1.0", "product": { "name": "Nozomi Networks Guardian <26.1.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.1.0", "product": { "name": "Nozomi Networks Guardian 26.1.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.1.0", "product": { "name": "Nozomi Networks CMC <26.1.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.1.0", "product": { "name": "Nozomi Networks CMC 26.1.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero", "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40900", "cwe": { "id": "CWE-1336", "name": "Improper Neutralization of Special Elements Used in a Template Engine" }, "discovery_date": "2026-05-19T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:3-01" } ], "notes": [ { "category": "summary", "text": "An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40900" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_3-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:3-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.1.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the Angular template executes in their browser context, allowing the attacker to modify application data, or disrupt application availability. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration." } ], "title": "Angular template injection in Reports in Guardian/CMC before 26.1.0" } ] } ``` ## [nn-2026:2-01](https://vulnerability.circl.lu/vuln/nn-2026%3A2-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "High", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0", "tracking": { "aliases": [ "CVE-2025-40899" ], "current_release_date": "2026-04-15T11:00:00.000Z", "id": "NN-2026:2-01", "initial_release_date": "2026-04-15T11:00:00.000Z", "revision_history": [ { "date": "2026-04-15T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.0.0", "product": { "name": "Nozomi Networks Guardian <26.0.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.0.0", "product": { "name": "Nozomi Networks Guardian 26.0.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.0.0", "product": { "name": "Nozomi Networks CMC <26.0.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.0.0", "product": { "name": "Nozomi Networks CMC 26.0.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40899", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-04-15T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:2-01" } ], "notes": [ { "category": "summary", "text": "A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40899" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_2-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:2-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones. Review existing custom fields.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.0.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.9, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victim views the Assets or Nodes pages, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information." } ], "title": "Stored Cross-Site Scripting (XSS) in Assets and Nodes in Guardian/CMC before 26.0.0" } ] } ``` ## [nn-2026:1-01](https://vulnerability.circl.lu/vuln/nn-2026%3A1-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "High", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0", "tracking": { "aliases": [ "CVE-2025-40897" ], "current_release_date": "2026-04-15T11:00:00.000Z", "id": "NN-2026:1-01", "initial_release_date": "2026-04-15T11:00:00.000Z", "revision_history": [ { "date": "2026-04-15T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.0.0", "product": { "name": "Nozomi Networks Guardian <26.0.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "26.0.0", "product": { "name": "Nozomi Networks Guardian 26.0.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<26.0.0", "product": { "name": "Nozomi Networks CMC <26.0.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "26.0.0", "product": { "name": "Nozomi Networks CMC 26.0.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40897", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "discovery_date": "2026-04-15T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2026:1-01" } ], "notes": [ { "category": "summary", "text": "An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40897" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_1-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2026:1-01" } ], "remediations": [ { "category": "mitigation", "details": "Remove or revoke access to Threat Intelligence users with view-only privileges until a fix is applied.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v26.0.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with view-only privileges for the Threat Intelligence functionality can perform administrative actions on it, altering the rules configuration, and/or affecting their availability." } ], "title": "Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0" } ] } ``` ## [nn-2025:18-01](https://vulnerability.circl.lu/vuln/nn-2025%3A18-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0", "tracking": { "aliases": [ "CVE-2025-40896" ], "current_release_date": "2026-03-04T11:00:00.000Z", "id": "NN-2025:18-01", "initial_release_date": "2026-03-04T11:00:00.000Z", "revision_history": [ { "date": "2026-03-04T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<2.2.0", "product": { "name": "Nozomi Networks Arc <2.2.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "2.2.0", "product": { "name": "Nozomi Networks Arc 2.2.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Arc" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Felix Eberstaller" ], "organization": "Limes Security", "summary": "finding this issue during a VAPT testing session commissioned by one of our customers" } ], "cve": "CVE-2025-40896", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2026-03-04T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2025:18-01" } ], "notes": [ { "category": "summary", "text": "The server certificate was not verified when an Arc agent connected to a Guardian or CMC.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002" ], "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40896" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2025_18-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2025:18-01" } ], "remediations": [ { "category": "mitigation", "details": "N/A", "product_ids": [ "CSAFPID-0001" ] }, { "category": "vendor_fix", "details": "Upgrade Arc to v2.2.0 or later.", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "threats": [ { "category": "impact", "details": "A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and sensitive information (such as assets and alerts), impersonation of the server, or injection of spoofed data (such as false asset information or vulnerabilities) into the Guardian or CMC." } ], "title": "Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0" } ] } ``` ## [nn-2025:17-01](https://vulnerability.circl.lu/vuln/nn-2025%3A17-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Low", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "HTML injection in Sensor Map in CMC before 25.6.0", "tracking": { "aliases": [ "CVE-2025-40895" ], "current_release_date": "2026-03-04T11:00:00.000Z", "id": "NN-2025:17-01", "initial_release_date": "2026-03-04T11:00:00.000Z", "revision_history": [ { "date": "2026-03-04T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.6.0", "product": { "name": "Nozomi Networks CMC <25.6.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "25.6.0", "product": { "name": "Nozomi Networks CMC 25.6.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40895", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-03-04T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2025:17-01" } ], "notes": [ { "category": "summary", "text": "A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map functionality due to improper validation on connected Guardians' properties.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002" ], "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40895" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2025_17-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2025:17-01" } ], "remediations": [ { "category": "mitigation", "details": "N/A", "product_ids": [ "CSAFPID-0001" ] }, { "category": "vendor_fix", "details": "Upgrade to v25.6.0 or later.", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "threats": [ { "category": "impact", "details": "A malicious authenticated user with administrator privileges on a Guardian connected to a CMC can edit the Guardian's properties to inject HTML tags. If the Sensor Map functionality is enabled in the CMC, when a victim CMC user interacts with it, then the injected HTML may render in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration." } ], "title": "HTML injection in Sensor Map in CMC before 25.6.0" } ] } ``` ## [nn-2025:16-01](https://vulnerability.circl.lu/vuln/nn-2025%3A16-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Low", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0", "tracking": { "aliases": [ "CVE-2025-40894" ], "current_release_date": "2026-03-04T11:00:00.000Z", "id": "NN-2025:16-01", "initial_release_date": "2026-03-04T11:00:00.000Z", "revision_history": [ { "date": "2026-03-04T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.6.0", "product": { "name": "Nozomi Networks Guardian <25.6.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "25.6.0", "product": { "name": "Nozomi Networks Guardian 25.6.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.6.0", "product": { "name": "Nozomi Networks CMC <25.6.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "25.6.0", "product": { "name": "Nozomi Networks CMC 25.6.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40894", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-03-04T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2025:16-01" } ], "notes": [ { "category": "summary", "text": "A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40894" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2026/nn-2025_16-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2025:16-01" } ], "remediations": [ { "category": "mitigation", "details": "N/A", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v25.6.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "A malicious authenticated user with the required privileges could edit a node label to inject HTML tags. If the system is configured to use the Alerted Nodes Dashboard, and alerts are reported for the affected node, then the injected HTML may render in the browser of a victim user interacting with it, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration." } ], "title": "HTML injection in Alerted Nodes Dashboard in Guardian/CMC before 25.6.0" } ] } ``` ## [nn-2025:15-01](https://vulnerability.circl.lu/vuln/nn-2025%3A15-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0", "tracking": { "aliases": [ "CVE-2025-40898" ], "current_release_date": "2025-12-18T11:00:00.000Z", "id": "NN-2025:15-01", "initial_release_date": "2025-12-18T11:00:00.000Z", "revision_history": [ { "date": "2025-12-18T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.5.0", "product": { "name": "Nozomi Networks Guardian <25.5.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "25.5.0", "product": { "name": "Nozomi Networks Guardian 25.5.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.5.0", "product": { "name": "Nozomi Networks CMC <25.5.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "25.5.0", "product": { "name": "Nozomi Networks CMC 25.5.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40898", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2025-12-18T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2025:15-01" } ], "notes": [ { "category": "summary", "text": "A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40898" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2025/nn-2025_15-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2025:15-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v25.5.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in arbitrary paths, altering the device configuration and/or affecting its availability." } ], "title": "Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0" } ] } ``` ## [nn-2025:14-01](https://vulnerability.circl.lu/vuln/nn-2025%3A14-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "HTML injection in Asset List in Guardian/CMC before 25.5.0", "tracking": { "aliases": [ "CVE-2025-40893" ], "current_release_date": "2025-12-18T11:00:00.000Z", "id": "NN-2025:14-01", "initial_release_date": "2025-12-18T11:00:00.000Z", "revision_history": [ { "date": "2025-12-18T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.5.0", "product": { "name": "Nozomi Networks Guardian <25.5.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "25.5.0", "product": { "name": "Nozomi Networks Guardian 25.5.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.5.0", "product": { "name": "Nozomi Networks CMC <25.5.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "25.5.0", "product": { "name": "Nozomi Networks CMC 25.5.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40893", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2025-12-18T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2025:14-01" } ], "notes": [ { "category": "summary", "text": "A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40893" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2025/nn-2025_14-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2025:14-01" } ], "remediations": [ { "category": "mitigation", "details": "N/A", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v25.5.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An unauthenticated attacker can send specially crafted network packets to inject HTML tags into asset attributes. When a victim views the affected assets in the Asset List (and similar functions), the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration." } ], "title": "HTML injection in Asset List in Guardian/CMC before 25.5.0" } ] } ``` ## [nn-2025:13-01](https://vulnerability.circl.lu/vuln/nn-2025%3A13-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "High", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0", "tracking": { "aliases": [ "CVE-2025-40892" ], "current_release_date": "2025-12-18T11:00:00.000Z", "id": "NN-2025:13-01", "initial_release_date": "2025-12-18T11:00:00.000Z", "revision_history": [ { "date": "2025-12-18T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.5.0", "product": { "name": "Nozomi Networks Guardian <25.5.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "25.5.0", "product": { "name": "Nozomi Networks Guardian 25.5.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.5.0", "product": { "name": "Nozomi Networks CMC <25.5.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "25.5.0", "product": { "name": "Nozomi Networks CMC 25.5.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40892", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2025-12-18T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2025:13-01" } ], "notes": [ { "category": "summary", "text": "A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40892" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2025/nn-2025_13-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2025:13-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones. Review existing report templates.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v25.5.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.9, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information." } ], "title": "Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0" } ] } ``` ## [nn-2025:12-01](https://vulnerability.circl.lu/vuln/nn-2025%3A12-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Low", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0", "tracking": { "aliases": [ "CVE-2025-40891" ], "current_release_date": "2025-12-18T11:00:00.000Z", "id": "NN-2025:12-01", "initial_release_date": "2025-12-18T11:00:00.000Z", "revision_history": [ { "date": "2025-12-18T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.5.0", "product": { "name": "Nozomi Networks Guardian <25.5.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "25.5.0", "product": { "name": "Nozomi Networks Guardian 25.5.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.5.0", "product": { "name": "Nozomi Networks CMC <25.5.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "25.5.0", "product": { "name": "Nozomi Networks CMC 25.5.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Stefano Libero", "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40891", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2025-12-18T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2025:12-01" } ], "notes": [ { "category": "summary", "text": "A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40891" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2025/nn-2025_12-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2025:12-01" } ], "remediations": [ { "category": "mitigation", "details": "N/A", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v25.5.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An unauthenticated attacker can send specially crafted network packets at two different times to inject HTML tags into asset attributes across two snapshots. Exploitation requires a victim to use the Time Machine Snapshot Diff feature on those specific snapshots and perform specific GUI actions, at which point the injected HTML renders in their browser, enabling phishing and open redirect attacks. Full XSS exploitation is prevented by input validation and Content Security Policy. Attack complexity is high due to multiple required conditions." } ], "title": "HTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0" } ] } ``` ## [nn-2025:11-01](https://vulnerability.circl.lu/vuln/nn-2025%3A11-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0", "tracking": { "aliases": [ "CVE-2025-40890" ], "current_release_date": "2025-11-26T11:00:00.000Z", "id": "NN-2025:11-01", "initial_release_date": "2025-11-25T11:00:00.000Z", "revision_history": [ { "date": "2025-11-25T11:00:00.000Z", "number": "1", "summary": "Initial revision" }, { "date": "2025-11-26T11:00:00.000Z", "number": "2", "summary": "Updated credits" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.4.0", "product": { "name": "Nozomi Networks Guardian <25.4.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "25.4.0", "product": { "name": "Nozomi Networks Guardian 25.4.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.4.0", "product": { "name": "Nozomi Networks CMC <25.4.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "25.4.0", "product": { "name": "Nozomi Networks CMC 25.4.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Humza Ahmad" ], "organization": "ENCS", "summary": "finding this issue during a VAPT testing session commissioned by one of our customers" } ], "cve": "CVE-2025-40890", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2025-11-25T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2025:11-01" } ], "notes": [ { "category": "summary", "text": "A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40890" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2025/nn-2025_11-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2025:11-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v25.4.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.9, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated low-privilege user can craft a malicious dashboard containing a JavaScript payload and share it with victim users, or a victim can be socially engineered to import a malicious dashboard template. When the victim views or imports the dashboard, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information." } ], "title": "Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0" } ] } ``` ## [nn-2025:9-01](https://vulnerability.circl.lu/vuln/nn-2025%3A9-01) ```json { "document": { "aggregate_severity": { "text": "HIGH" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0", "tracking": { "aliases": [ "CVE-2025-40889" ], "current_release_date": "2025-10-07T11:00:00.000Z", "id": "NN-2025:9-01", "initial_release_date": "2025-10-07T11:00:00.000Z", "revision_history": [ { "date": "2025-10-07T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.2.0", "product": { "name": "Nozomi Networks Guardian <25.2.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "25.2.0", "product": { "name": "Nozomi Networks Guardian 25.2.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.2.0", "product": { "name": "Nozomi Networks CMC <25.2.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "25.2.0", "product": { "name": "Nozomi Networks CMC 25.2.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40889", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2025-10-07T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2025:9-01" } ], "notes": [ { "category": "summary", "text": "A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40889" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2025/nn-2025_9-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2025:9-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v25.2.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with limited privileges, by issuing a specifically-crafted request, can potentially alter the structure and content of files in the /data folder, and/or affect their availability." } ], "title": "Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0" } ] } ``` ## [nn-2025:8-01](https://vulnerability.circl.lu/vuln/nn-2025%3A8-01) ```json { "document": { "aggregate_severity": { "text": "MEDIUM" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "Medium", "title": "Risk Level for Nozomi customers" } ], "publisher": { "category": "vendor", "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com", "name": "Nozomi Networks Product Security", "namespace": "https://security.nozominetworks.com/psirt" }, "title": "Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0", "tracking": { "aliases": [ "CVE-2025-40887" ], "current_release_date": "2025-10-07T11:00:00.000Z", "id": "NN-2025:8-01", "initial_release_date": "2025-10-07T11:00:00.000Z", "revision_history": [ { "date": "2025-10-07T11:00:00.000Z", "number": "1", "summary": "Initial revision" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.2.0", "product": { "name": "Nozomi Networks Guardian <25.2.0", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "25.2.0", "product": { "name": "Nozomi Networks Guardian 25.2.0", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Guardian" }, { "branches": [ { "category": "product_version_range", "name": "vers:gem/<25.2.0", "product": { "name": "Nozomi Networks CMC <25.2.0", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "25.2.0", "product": { "name": "Nozomi Networks CMC 25.2.0", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "CMC" } ], "category": "vendor", "name": "Nozomi Networks" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Andrea Palanca" ], "organization": "Nozomi Networks Product Security team", "summary": "finding this issue during an internal investigation" } ], "cve": "CVE-2025-40887", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "discovery_date": "2025-10-07T11:00:00.000Z", "ids": [ { "system_name": "Nozomi Networks Security Advisory ID", "text": "NN-2025:8-01" } ], "notes": [ { "category": "summary", "text": "A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter.", "title": "Vulnerability summary" } ], "product_status": { "fixed": [ "CSAFPID-0002", "CSAFPID-0004" ], "known_affected": [ "CSAFPID-0001", "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "Mitre CVE entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40887" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.nozominetworks.com/csaf/2025/nn-2025_8-01.json" }, { "category": "self", "summary": "Human-readable advisory.", "url": "https://security.nozominetworks.com/NN-2025:8-01" } ], "remediations": [ { "category": "mitigation", "details": "Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] }, { "category": "vendor_fix", "details": "Upgrade to v25.2.0 or later.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003" ] } ], "threats": [ { "category": "impact", "details": "An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data." } ], "title": "Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0" } ] } ```