CVE-2021-26724

OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NozomiCNA
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
VendorProductVersion
nozominetworkscentral_management_control
19.0.0 ≤
𝑥
≤ 19.0.12
nozominetworkscentral_management_control
20.0.0.0 ≤
𝑥
< 20.0.7.4
nozominetworksguardian
19.0.0 ≤
𝑥
< 19.0.12
nozominetworksguardian
20.0.0.0 ≤
𝑥
< 20.0.7.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://security.nozominetworks.com/NN-2021:1-01
https://security.nozominetworks.com/NN-2021:1-01