Guardian/CMC: OS command injection in update function
Summary
Two OS command injection vulnerabilities in the update installation function of Nozomi Networks Guardian and CMC allow arbitrary commands to run with root privileges. The cause is insufficient validation of update bundle contents. An attacker needs administrative privileges and must get a crafted update bundle installed, for example via the web management interface. Successful exploitation allows reading or modifying sensitive data, changing the appliance configuration, or shutting down the appliance.
Affected
- Nozomi Guardian: versions before 26.4.0
- Nozomi CMC: versions before 26.4.0
- Versions 26.4.0 and later are not affected.
Fixed in
- Upgrade to version 26.4.0 or later (vendor advisory NN-2026:22-01).
Workaround
- Use internal firewall features to limit access to the web management interface.
- Review all accounts with administrative privileges and delete unnecessary ones.
- Install update bundles only when they come from trusted Nozomi Networks sources.
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No evidence of exploitation in the wild and no public proof of concept known at the time of writing.
- The CVE is only a few days old, so this may change.
Our recommendation
- Upgrade Guardian and CMC to version 26.4.0 or later in the next maintenance window.
- Until then, restrict access to the management interface to dedicated admin networks.
- Review administrative accounts and remove unnecessary ones.
- Install update bundles only from trusted Nozomi Networks sources.
- Monitor for unexpected update uploads and review audit logs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Nozomi Networks advisory NN-2026:22-01 security.nozominetworks.com
- CVE-2026-33924 on cve.threatint.com cve.threatint.com
- CVE-2026-33924 on Strix www.strix.ai
- VulDB entry 428353 vuldb.com
- CVE-2026-33924 on OffSeq Radar radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 11:26.
Original description (NVD)
Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to be executed with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.