CVE-2021-26724CWE-78

Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4

High · published February 22, 2021

CVSS v4.0
8.6
EPSS
3%
Percentile
86.2
In the wild
Unconfirmed
What it is

OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02769 · 86.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-02-22T20:31Z
EPSS history
Timeline
  • 22 FEB 20:31Z
    Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4
    cvelistv5