Lucene search

NozomiCVE-2021-26724

HistoryFeb 22, 2021 - 9:15 p.m.

CVE-2021-26724

2021-02-2221:15:19

CWE-78

Nozomi

web.nvd.nist.gov

cve-2021-26724

os command injection

nozomi networks guardian

nozomi networks cmc

remote code execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

55.2%

JSON

OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.

Affected configurations

Nvd

Node

nozominetworkscentral_management_controlRange19.0.0–19.0.12

nozominetworkscentral_management_controlRange20.0.0.0–20.0.7.4

nozominetworksguardianRange19.0.0–19.0.12

nozominetworksguardianRange20.0.0.0–20.0.7.4

VendorProductVersionCPE
nozominetworkscentral_management_control*cpe:2.3:a:nozominetworks:central_management_control:*:*:*:*:*:*:*:*
nozominetworksguardian*cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nozominetworks	central_management_control	*	cpe:2.3:a:nozominetworks:central_management_control::::::::
nozominetworks	guardian	*	cpe:2.3:a:nozominetworks:guardian::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Guardian",
    "vendor": "Nozomi Networks",
    "versions": [
      {
        "status": "affected",
        "version": "20.0.7.3 and prior versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CMC",
    "vendor": "Nozomi Networks",
    "versions": [
      {
        "status": "affected",
        "version": "20.0.7.3 and prior versions",
        "versionType": "custom"
      }
    ]
  }
]

References

security.nozominetworks.com/NN-2021:1-01

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

55.2%

JSON

Related for CVE-2021-26724