CVE-2021-26725highCWE-24

CVE-2021-26725: fallo de gravedad alta en Nozomi Networks Guardian

Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear CMC+ Monitorear Guardian

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 1.1%
Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected system files. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Nozomi Networks · CMCNozomi Networks · Guardian
CVEs relacionadas — Nozomi Networks Guardian

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-26724HIGHAuthenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4EPSS 2.8%CVE-2026-33924HIGHAuthenticated RCE in update functionality in Guardian/CMC before 26.4.0EPSS 1.1%CVE-2024-13089HIGHAuthenticated RCE in update functionality in Guardian/CMC before 24.6.0EPSS 1.1%CVE-2022-0551HIGHAuthenticated RCE on project configuration import in Guardian/CMC before 22.0.0EPSS 0.9%CVE-2022-0550HIGHAuthenticated RCE on logo report upload in Guardian/CMC before 22.0.0EPSS 0.9%CVE-2023-32649HIGHDoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0EPSS 0.6%