Update bundle signature bypass in Nozomi Networks Guardian and CMC
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
Nozomi Networks Guardian and CMC from 0 before 26.4.0 contain a signature verification flaw in the update installation functionality. The update validation is inconsistent, so it does not check the full contents of an update bundle (CWE-347). An attacker with administrative privileges can supply a crafted update bundle that passes signature verification but runs an unsigned script with root privileges when installed. The script can read or modify sensitive data, change the appliance configuration, or shut down the appliance.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsigned script when the bundle is installed. The script runs with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Nozomi Networks | Guardian | before 26.4.0 | 26.4.0 | Patch available | CNA |
| Nozomi Networks | CMC | before 26.4.0 | 26.4.0 | Patch available | CNA |
- Guardian VendorNozomi Networks Affected before 26.4.0 Fixed in 26.4.0 Patch available CNA
- CMC VendorNozomi Networks Affected before 26.4.0 Fixed in 26.4.0 Patch available CNA
Remediation
Update Nozomi Networks Guardian and CMC to version 26.4.0 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Guardian (Nozomi Networks) Fixed in 26.4.0
- Fix · CNA CMC (Nozomi Networks) Fixed in 26.4.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Nozomi Networks CMC, Guardian 26.4.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-82344 Authenticated RCE in update functionality in Guardian and CMCPriority LOW 37
Timeline
- 2026-10-29 Threatist record created from CVE-2026-33923
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: MEDIUM → LOW
- 2026-10-29 Alias added: GHSA-9v7w-2fr3-g7q8
References
More Nozomi Networks vulnerabilities
- TI-2022-00470 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 CVSS 4.0HIGH 8.6
- TI-2026-24526 DoS through oversized audit log entries in Guardian/CMC before 26.2.0 CVSS 4.0HIGH 8.7
- TI-2023-15926 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 CVSS 4.0HIGH 8.2
- TI-2023-13657 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 CVSS 4.0CRITICAL 9.2
- TI-2024-00196 DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1 CVSS 4.0HIGH 8.2
- TI-2021-08402 Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4 CVSS 4.0HIGH 8.6
Sources
- CVE-2026-33923 · CVE Program
- CVE-2026-33923 · NVD
- FIRST EPSS
- GHSA-9v7w-2fr3-g7q8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences