Most recent entries from csaf_nozominetworks

NN-2026:20-01 — Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc be…

Tue, 08 Sep 2026 11:00:00 +0000

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it.

NN-2026:19-01 — Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

Tue, 08 Sep 2026 11:00:00 +0000

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges.

NN-2026:18-01 — Cross-site request forgery in the Guardian/CMC login before 26.3.0

Tue, 08 Sep 2026 11:00:00 +0000

A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token.

NN-2026:17-01 — Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

Tue, 08 Sep 2026 11:00:00 +0000

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges.

NN-2026:16-01 — Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0

Tue, 08 Sep 2026 11:00:00 +0000

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.

NN-2026:15-01 — Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0

Tue, 11 Aug 2026 11:00:00 +0000

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter.

NN-2026:14-01 — Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0

Tue, 11 Aug 2026 11:00:00 +0000

The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only.

NN-2026:9-01 — Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0

Tue, 07 Jul 2026 11:00:00 +0000

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter.

NN-2026:8-01 — HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0

Tue, 07 Jul 2026 11:00:00 +0000

A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive.

NN-2026:13-01 — Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0

Tue, 07 Jul 2026 11:00:00 +0000

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions.