---
id: "CVE-2026-33923"
kind: "vulnerability"
aliases: ["CVE-2026-33923"]
title: "Appliance update bundles can run unsigned root scripts after signature check"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Nozomi Networks Guardian", "fixed": ["26.4.0"], "affected": "< 26.4.0", "ecosystem": "vendor"}, {"name": "Nozomi Networks CMC", "fixed": ["26.4.0"], "affected": "< 26.4.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["appliance", "cmc", "firmware-updates", "guardian", "infrastructure", "network-appliance", "nozomi-networks", "ot-security"]
not_affected_if: ["no-untrusted-admin-accounts", "unknown", "v26.4.0-or-later", "web-management-interface-not-reachable"]
published_at: "2026-10-29T11:17:32+00:00"
first_seen_at: "2026-10-29T11:24:28+00:00"
updated_at: "2026-10-29T11:26:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33923", "first_seen_at": "2026-10-29T11:24:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T11:26:58+00:00"}]
---

# Appliance update bundles can run unsigned root scripts after signature check

An update bundle can pass signature verification while still carrying an unsigned script that the appliance runs during installation. The script runs as root, so an attacker can read or change sensitive data, alter the configuration, or shut the appliance down.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nozomi Networks Guardian affected < 26.4.0 fixed 26.4.0
- vendor:Nozomi Networks CMC affected < 26.4.0 fixed 26.4.0

## How to check

Check the N2OS version of each Guardian and CMC appliance (web UI); any version below 26.4.0 is affected. Also review which accounts hold administrative privileges.

## Fix

Upgrade Nozomi Guardian/CMC to v26.4.0 or later; install update bundles only from trusted Nozomi Networks sources.

## Timeline

- 2026-10-29T11:24:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-33923
- 2026-10-29T11:26:58+00:00 analyst — Nozomi Networks advisory NN-2026:21-01 read: Guardian/CMC < 26.4.0, fixed in 26.4.0. No exploitation or PoC found; no social search done (B tier, niche OT appliance).

## Documents

- [advisory] NN-2026:21-01 Update bundle signature bypass in Guardian/CMC before 26.4.0 https://security.nozominetworks.com/NN-2026:21-01/

## From the sources

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsigned script when the bundle is installed. The script runs with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_