Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4
Vulnerability Description
OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-26724
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- This bug was found by Erik de Jong
More from Nozomi Networks
View All →Affected Vendor
Nozomi Networks
View all reports →