Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4
Priority MEDIUM 42CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.
Why it matters now
EPSS 0.02769 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Nozomi Networks | Guardian | 20.0.7.3 and prior versions | — | No fix listed | CNA |
| Nozomi Networks | CMC | 20.0.7.3 and prior versions | — | No fix listed | CNA |
- Guardian VendorNozomi Networks Affected 20.0.7.3 and prior versions Fixed in — No fix listed CNA
- CMC VendorNozomi Networks Affected 20.0.7.3 and prior versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nozominetworks:central_management_control:*:*:*:*:*:*:*:* | 19.0.0 – 19.0.12; 20.0.0.0 to before 20.0.7.4 | Vulnerable | Nozomi Networks |
| cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:* | 19.0.0 to before 19.0.12; 20.0.0.0 to before 20.0.7.4 | Vulnerable | Nozomi Networks |
- cpe:2.3:a:nozominetworks:central_management_control:*:*:*:*:*:*:*:* Versions 19.0.0 – 19.0.12; 20.0.0.0 to before 20.0.7.4 Vulnerable ·Nozomi Networks
- cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:* Versions 19.0.0 to before 19.0.12; 20.0.0.0 to before 20.0.7.4 Vulnerable ·Nozomi Networks
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26724
- 2026-10-03 Alias added: GHSA-h84w-4wfq-6h9c
References
More Nozomi Networks Central Management Control vulnerabilities
- TI-2021-08403 Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4 CVSS 4.0HIGH 8.6
Sources
- CVE-2021-26724 · CVE Program
- CVE-2021-26724 · NVD
- FIRST EPSS
- GHSA-h84w-4wfq-6h9c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences