Lucene search

NozomiCVE-2021-26725

HistoryFeb 22, 2021 - 9:15 p.m.

CVE-2021-26725

2021-02-2221:15:19

CWE-22

CWE-24

Nozomi

web.nvd.nist.gov

cve-2021-26725

path traversal

nozomi networks

guardian

cmc

nvd

vulnerability

security

timezone

web gui

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

Confidence

High

EPSS

0.001

Percentile

39.7%

JSON

Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected system files. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.

Affected configurations

Nvd

Node

nozominetworkscentral_management_controlRange19.0.0–19.0.12

nozominetworkscentral_management_controlRange20.0.0.0–20.0.7.4

nozominetworksguardianRange19.0.0–19.0.12

nozominetworksguardianRange20.0.0.0–20.0.7.4

VendorProductVersionCPE
nozominetworkscentral_management_control*cpe:2.3:a:nozominetworks:central_management_control:*:*:*:*:*:*:*:*
nozominetworksguardian*cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nozominetworks	central_management_control	*	cpe:2.3:a:nozominetworks:central_management_control::::::::
nozominetworks	guardian	*	cpe:2.3:a:nozominetworks:guardian::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Guardian",
    "vendor": "Nozomi Networks",
    "versions": [
      {
        "status": "affected",
        "version": "20.0.7.3 and prior versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CMC",
    "vendor": "Nozomi Networks",
    "versions": [
      {
        "status": "affected",
        "version": "20.0.7.3 and prior versions",
        "versionType": "custom"
      }
    ]
  }
]

References

security.nozominetworks.com/NN-2021:2-01

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

Confidence

High

EPSS

0.001

Percentile

39.7%

JSON

Related for CVE-2021-26725