TLS Verification Disabled in Remote Collector of Guardian and CMC by Nozomi Networks
CVE-2026-31985
8.3HIGH
What is CVE-2026-31985?
A configuration issue in the Remote Collector of Nozomi Networks' Guardian and CMC renders TLS certificate verification ineffective. This flaw allows attackers to execute man-in-the-middle attacks, intercepting communications between the Remote Collector and the Guardian or CMC. Without proper certificate validation, sensitive information such as sync tokens can be compromised, enabling attackers to impersonate legitimate servers and insert fraudulent data into the system, thereby disrupting data integrity and operational reliability.
Affected Version(s)
Remote Collector 0 < 26.2.0
References
CVSS V4
Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was found by Andrea Palanca of Nozomi Networks Product Security team during an internal investigation.