CVE-2021-26725

Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4

Published Feb 22, 2021 CVSS 4.0 · 8.6 High EPSS 1.1% KEV · Not listed
Description
Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected system files. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.

Remediation

Vendor Solution

v19 series: Upgrade to v19.0.12. v20 series: Upgrade to v20.0.7.4.


Vendor Workaround

Use internal firewall feature to limit management interface access and review user roles.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2021-13512 Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected system files. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
Nozomi
Published
Updated
Sep 17, 2024, 2:24 PM
Reserved
Feb 5, 2021, 12:00 AM
Status
Modified
Published
Feb 22, 2021, 9:15 PM
Modified
Jun 17, 2026, 3:43 AM