Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4
view advisory published 2021-02-22
A published security advisory; the vulnerabilities below are the ones it describes.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-26724US | high7.2 | — | ||
OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote c… | ||||
02
remediations (4)
- MitigationCMC
Use internal firewall feature to limit management interface access and review user roles.
- MitigationGuardian
Use internal firewall feature to limit management interface access and review user roles.
- FixedCMC
v19 series: Upgrade to v19.0.12. v20 series: Upgrade to v20.0.7.4.
- FixedGuardian
v19 series: Upgrade to v19.0.12. v20 series: Upgrade to v20.0.7.4.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan