Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Nozomi Networks | Guardian | unaffected |
|
||||||
| Nozomi Networks | CMC | unaffected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Vendor Solution
v19 series: Upgrade to v19.0.12. v20 series: Upgrade to v20.0.7.4.
Vendor Workaround
Use internal firewall feature to limit management interface access and review user roles.
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2021-13512 | Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected system files. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions. |
No CVSS v3.0
This CVE is not in the KEV list.
Exploit prediction score: 1.1% (1.097% probability within 30 days)
| Link | Providers |
|---|---|
| https://security.nozominetworks.com/NN-2021:2-01 |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|