{"id":"CVE-2026-33923","kind":"vulnerability","aliases":["CVE-2026-33923"],"related":[],"title":"Appliance update bundles can run unsigned root scripts after signature check","description":"A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsigned script when the bundle is installed. The script runs with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.","summary":"An update bundle can pass signature verification while still carrying an unsigned script that the appliance runs during installation. The script runs as root, so an attacker can read or change sensitive data, alter the configuration, or shut the appliance down.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nozomi Networks Guardian","fixed":["26.4.0"],"affected":"< 26.4.0","ecosystem":"vendor"},{"name":"Nozomi Networks CMC","fixed":["26.4.0"],"affected":"< 26.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["appliance","cmc","firmware-updates","guardian","infrastructure","network-appliance","nozomi-networks","ot-security"],"not_affected_if":["no-untrusted-admin-accounts","unknown","v26.4.0-or-later","web-management-interface-not-reachable"],"how_to_check":"Check the N2OS version of each Guardian and CMC appliance (web UI); any version below 26.4.0 is affected. Also review which accounts hold administrative privileges.","fix":"Upgrade Nozomi Guardian/CMC to v26.4.0 or later; install update bundles only from trusted Nozomi Networks sources.","status":"open","published_at":"2026-10-29T11:17:32+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","triaged_at":"2026-10-29T11:25:28+00:00","updated_at":"2026-10-29T11:26:58+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-29T11:25:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Appliance update bundles can run unsigned root scripts after signature check","impact":"high","summary":"An update bundle can pass signature verification while still carrying an unsigned script that the appliance runs during installation. The script runs as root, so an attacker can read or change sensitive data, alter the configuration, or shut the appliance down.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["appliance","network-appliance","firmware-updates"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Root code runs on the appliance; data read or changed","analyst_note":"Identify the affected appliance vendor and product versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-33923 and find the vendor advisory for the fix and detection steps.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Affects network appliances whose update installation accepts bundles from an administrator account, according to the NVD description. Teams that run no such appliance, or that restrict who can upload updates, are less exposed. The sources do not name the product or versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":4153,"output_tokens":469,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected appliance vendor and product versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-33923 and find the vendor advisory for the fix and detection steps.","search":"'-2026':13A,16A '-33923':14A,17A 'administr':103C 'allow':132C 'alter':73B 'applianc':1A,24B,33B,55B,79B,143C,149C 'attack':66B,101C,134C 'bundl':3A,42B,98C,111C,123C 'carri':49B 'chang':70B,141C 'check':11A 'cmc':23A,25B 'configur':75B,144C 'content':99C 'craft':109C 'cve':12A,15A 'data':72B,140C 'discov':85C 'due':91C 'firmwar':27B 'firmware-upd':26B 'function':90C 'guardian':20A,29B 'inconsist':93C 'infrastructur':30B 'instal':58B,89C,125C 'modifi':138C 'network':32B,36B 'network-appli':31B 'networks':19A,22A 'nozomi':18A,21A,35B 'nozomi-network':34B 'ot':38B 'ot-secur':37B 'pass':44B,113C 'privileg':104C,131C 'read':68B,136C 'remot':106C 'root':7A,63B,130C 'run':5A,56B,61B,117C,128C 'script':8A,52B,60B,120C,127C 'secur':39B 'sensit':71B,139C 'shut':77B,146C 'signatur':10A,45B,81C,114C 'still':48B 'suppli':107C 'unsign':6A,51B,119C 'updat':2A,28B,41B,88C,97C,110C 'valid':94C 'verif':46B,82C,115C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Affects Nozomi Networks Guardian and CMC appliances older than v26.4.0. An attacker needs administrative access to the web interface, then can upload a crafted update bundle that passes signature checks but runs an unsigned script as root. Teams not running these products, or on 26.4.0 or later, can skip it; others should upgrade and restrict admin access.","tier":"B","verified":{"fix":{"at":"2026-10-29T11:26:58Z","by":"analyst","doc":"https://security.nozominetworks.com/NN-2026:21-01/","run_id":1015},"products":{"at":"2026-10-29T11:26:58Z","by":"analyst","doc":"https://security.nozominetworks.com/NN-2026:21-01/","run_id":1015},"workarounds":{"at":"2026-10-29T11:26:58Z","by":"analyst","doc":"https://security.nozominetworks.com/NN-2026:21-01/","run_id":1015},"how_to_check":{"at":"2026-10-29T11:26:58Z","by":"analyst","doc":"https://security.nozominetworks.com/NN-2026:21-01/","run_id":1015},"who_affected":{"at":"2026-10-29T11:26:58Z","by":"analyst","doc":"https://security.nozominetworks.com/NN-2026:21-01/","run_id":1015}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T11:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"prodsec@nozominetworks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-33923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33923","severity":null,"published_at":"2026-10-29T11:17:32+00:00","modified_at":"2026-10-29T11:17:32+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","fetched_at":"2026-10-29T11:24:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-33923:1015","url":null,"severity":null,"published_at":"2026-10-29T11:26:58+00:00","modified_at":"2026-10-29T11:26:58+00:00","first_seen_at":"2026-10-29T11:26:58+00:00","fetched_at":"2026-10-29T11:26:58+00:00","note":"Nozomi Networks advisory NN-2026:21-01 read: Guardian/CMC < 26.4.0, fixed in 26.4.0. No exploitation or PoC found; no social search done (B tier, niche OT appliance)."}],"documents":[{"id":16112,"url":"https://security.nozominetworks.com/NN-2026:21-01/","title":"NN-2026:21-01 Update bundle signature bypass in Guardian/CMC before 26.4.0","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}