CVE-2026-33922: fallo de gravedad media en Nozomi Networks Arc
Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.8epss 0.2%
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Nozomi Networks · ArcCVEs relacionadas — Nozomi Networks Arc
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-5938HIGHPath traversal via 'zip slip' in Arc before v1.6.0EPSS 0.7%CVE-2026-33389MEDIUMDisabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0EPSS 0.2%CVE-2023-5935HIGHMissing authentication for local web interface in Arc before v1.6.0EPSS 0.2%CVE-2023-5936HIGHUnsafe temporary data privileges on Unix systems in Arc before v1.6.0EPSS 0.1%CVE-2023-5937MEDIUMSensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0EPSS 0.1%CVE-2026-33921MEDIUMNpcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0EPSS 0.1%