Live › vulnerability › CVE-2026-33923
An update bundle can pass signature verification while still carrying an unsigned script that the appliance runs during installation. The script runs as root, so an attacker can read or change sensitive data, alter the configuration, or shut the appliance down.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
Affects Nozomi Networks Guardian and CMC appliances older than v26.4.0. An attacker needs administrative access to the web interface, then can upload a crafted update bundle that passes signature checks but runs an unsigned script as root. Teams not running these products, or on 26.4.0 or later, can skip it; others should upgrade and restrict admin access.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Nozomi Networks Guardian | vendor | < 26.4.0 | 26.4.0 |
| Nozomi Networks CMC | vendor | < 26.4.0 | 26.4.0 |
26.4.0 is affectedUpgrade Nozomi Guardian/CMC to v26.4.0 or later; install update bundles only from trusted Nozomi Networks sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsigned script when the bundle is installed. The script runs with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.
This page as .md · .json · in your agent: get_signal("CVE-2026-33923")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.