Medium severity · published Feb 22, 2021
CVE-2021-26725
Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected system files
4.9
CVSS
1.1%
EPSS
No
On KEV
Description
Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected system files. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Central Management Control · Nozominetworks
19.0.0 through 19.0.12; 20.0.0.0 before 20.0.7.4 · source: NVD
GU
Guardian · Nozominetworks
19.0.0 before 19.0.12; 20.0.0.0 before 20.0.7.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26725
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26725
Vendor Advisory
https://security.nozominetworks.com/NN-2021:2-01
More from Central Management Control
7.2
CVE-2023-6916
Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1
7.2
CVE-2021-26724
OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote…