CVE-2021-26724: Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-22 · updated 2026-06-17
Weakness: CWE-78

Description

OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.

Affected products

Nozominetworks Central Management Control: from 19.0.0 through 19.0.12; from 20.0.0.0 before 20.0.7.4 — fixed in 20.0.7.4
Nozomi Networks Guardian: from 19.0.0 before 19.0.12; from 20.0.0.0 before 20.0.7.4 — fixed in 19.0.12, 20.0.7.4

How to fix

Upgrade to a fixed version: Nozominetworks Central Management Control 20.0.7.4; Nozomi Networks Guardian 19.0.12, 20.0.7.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-26724 or the next vulnerability affects your stack