Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4
CVE-2021-26724

7.2HIGH

Key Information:

Vendor

Nozomi Networks

Status
Guardian
Cmc
Vendor
CVE Published:
22 February 2021

What is CVE-2021-26724?

OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.

Affected Version(s)

CMC 20.0.7.3 and prior versions

Guardian 20.0.7.3 and prior versions

References

https://security.nozominetworks.com/NN-2021:1-01
x_refsource_CONFIRM

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This bug was found by Erik de Jong
.