{"id":"CVE-2026-33924","kind":"vulnerability","aliases":["CVE-2026-33924"],"related":[],"title":"Appliance update installer lets an admin run root commands via crafted bundle","description":"Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to be executed with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance.","summary":"Two OS command injection flaws in the update installer of Nozomi Networks Guardian and CMC before 26.4.0. An admin can upload a crafted update bundle that runs commands as root. Fixed in 26.4.0.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nozomi Networks Guardian","fixed":["26.4.0"],"affected":"< 26.4.0","ecosystem":"vendor"},{"name":"Nozomi Networks CMC","fixed":["26.4.0"],"affected":"< 26.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["appliance","cmc","guardian","infrastructure","nozomi","ot-security","update-bundle"],"not_affected_if":["management-interface-restricted","no-admin-exposure"],"how_to_check":"Check the Guardian/CMC software version in the web UI or CLI; any version below 26.4.0 is affected. Also review which accounts hold administrative privileges.","fix":"Upgrade Nozomi Networks Guardian and CMC to v26.4.0 or later.","status":"open","published_at":"2026-10-29T11:17:33+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","triaged_at":"2026-10-29T11:25:25+00:00","updated_at":"2026-10-29T11:26:52+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-29T11:25:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Appliance update installer lets an admin run root commands via crafted bundle","impact":"high","summary":"The update installation feature of an appliance does not validate update bundle contents, so OS commands can be injected. An attacker with administrative privileges can supply a crafted update bundle that runs arbitrary commands as root, enabling data access, configuration changes, or shutdown.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["appliance","update-bundle"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs commands as root, reads or modifies data","analyst_note":"Identify the affected appliance product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-33924 and vendor advisory.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-admin-exposure"],"who_is_affected":"Affects appliances whose update installation feature accepts update bundles from an administrator. Systems where only trusted staff can upload updates and no administrative accounts are exposed face lower risk. The sources do not name the affected product or versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":4145,"output_tokens":471,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected appliance product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-33924 and vendor advisory.","search":"'-2026':14A,17A '-33924':15A,18A '26.4.0':52B,68B 'admin':6A,54B 'administr':93C 'allow':114C 'applianc':1A,25B,125C,131C 'arbitrari':106C 'attack':91C,116C 'bundl':12A,35B,60B,88C,101C 'caus':105C 'chang':123C 'cmc':24A,26B,50B 'command':9A,38B,63B,71C,107C 'configur':126C 'content':89C 'craft':11A,58B,99C 'cve':13A,16A 'data':122C 'discov':75C 'due':81C 'execut':110C 'fix':66B 'flaw':40B 'function':80C 'guardian':21A,27B,48B 'infrastructur':28B 'inject':39B,72C 'instal':3A,44B,79C,104C 'insuffici':83C 'let':4A 'modifi':120C 'network':47B 'networks':20A,23A 'nozomi':19A,22A,29B,46B 'os':37B,70C 'ot':31B 'ot-secur':30B 'privileg':94C,113C 'read':118C 'remot':96C 'root':8A,65B,112C 'run':7A,62B 'secur':32B 'sensit':121C 'shut':128C 'suppli':97C 'two':36B,69C 'updat':2A,34B,43B,59B,78C,87C,100C 'update-bundl':33B 'upload':56B 'valid':84C 'via':10A 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Nozomi Networks Guardian sensors or Central Management Console (CMC) older than 26.4.0, including the Siemens RUGGEDCOM APE1808, which embeds Nozomi software (Siemens status not checked here). The attacker needs an administrator account on the web management interface, then uploads a crafted update bundle that runs commands as root. Deployments where the management interface is firewalled and admin accounts are few and trusted are at lower risk.","tier":"B","verified":{"fix":{"at":"2026-10-29T11:26:52Z","by":"analyst","doc":"https://security.nozominetworks.com/NN-2026:22-01","run_id":1014},"products":{"at":"2026-10-29T11:26:52Z","by":"analyst","doc":"https://security.nozominetworks.com/NN-2026:22-01","run_id":1014},"workarounds":{"at":"2026-10-29T11:26:52Z","by":"analyst","doc":"https://security.nozominetworks.com/NN-2026:22-01","run_id":1014},"how_to_check":{"at":"2026-10-29T11:26:52Z","by":"analyst","doc":"https://security.nozominetworks.com/NN-2026:22-01","run_id":1014},"who_affected":{"at":"2026-10-29T11:26:52Z","by":"analyst","doc":"https://security.nozominetworks.com/NN-2026:22-01","run_id":1014}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T11:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"prodsec@nozominetworks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-33924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33924","severity":null,"published_at":"2026-10-29T11:17:33+00:00","modified_at":"2026-10-29T11:17:33+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","fetched_at":"2026-10-29T11:24:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-33924:1014","url":null,"severity":null,"published_at":"2026-10-29T11:26:52+00:00","modified_at":"2026-10-29T11:26:52+00:00","first_seen_at":"2026-10-29T11:26:52+00:00","fetched_at":"2026-10-29T11:26:52+00:00","note":"Nozomi Networks advisory NN-2026:22-01 read; Guardian/CMC < 26.4.0, fixed in 26.4.0. Sibling CVE-2026-33923 (NN-2026:21-01, signature bypass) fixed same version. No exploitation or PoC found; no social search done (B tier)."}],"documents":[{"id":16111,"url":"https://security.nozominetworks.com/NN-2026:22-01","title":"NN-2026:22-01 Authenticated RCE in update functionality in Guardian/CMC before 26.4.0","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}