Guardian/CMC: OS command injection in update function
Two OS command injection vulnerabilities in the update installation function of Nozomi Networks Guardian and CMC allow arbitrary commands to run with root privileges. The cause is insufficient validation of update bundle contents. An attacker needs administrative privileges and must get a crafted update bundle installed, for example via the web management interface. Successful exploitation allows reading or modifying sensitive data, changing the appliance configuration, or shutting down the appliance.
Nozomi Networks · Guardian and CMC
