Nozomi Guardian/CMC: Signature verification bypass in update bundles
Summary
Nozomi Networks Guardian and Central Management Console (CMC) before version 26.4.0 contain a flaw in update bundle validation. An attacker with administrative privileges can supply a crafted update bundle that passes signature verification but runs an unsigned script with root privileges during installation. This allows reading or modifying sensitive data, changing the appliance configuration, or shutting down the appliance.
Affected
- Nozomi Networks Guardian before 26.4.0
- Nozomi Networks CMC before 26.4.0
Fixed in
- Upgrade to Guardian v26.4.0 or later
- Upgrade to CMC v26.4.0 or later
Workaround
- Use internal firewall features to limit access to the web management interface.
- Review all accounts with administrative privileges and delete unnecessary ones.
- Install update bundles only when they come from trusted Nozomi Networks sources.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not known to be exploited in the wild at the time of research.
- No public proof of concept indexed at the time of research.
- Attack requires administrative privileges and network access to the management interface.
Our recommendation
- Check whether Guardian or CMC is in use; if not, no action is needed.
- Upgrade affected appliances to v26.4.0 or later, together with the related fix for CVE-2026-33924 (advisory NN-2026:22-01).
- Restrict access to the web management interface and review administrative accounts.
- Install update bundles only from Nozomi's official channels.
- Verify the details against the vendor advisory NN-2026:21-01, as it could not be retrieved directly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Nozomi Networks advisory NN-2026:21-01 security.nozominetworks.com
- VulDB CVE-2026-33923 vuldb.com
- OffSeq Radar CVE-2026-33923 radar.offseq.com
- Strix CVE-2026-33923 www.strix.ai
- Nozomi Central Management Console Administrator Guide technicaldocs.nozominetworks.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 11:27.
Original description (NVD)
A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsigned script when the bundle is installed. The script runs with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.