What’s Vulnerable › Vulnerabilities

CVE-2023-24471: Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-09 · updated 2026-06-17
• Weakness: CWE-863

Description

An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality. An authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data that would normally be not accessible in the Query and Assertions functions.

Affected products

• Nozomi Networks CMC: before 22.6.2 — fixed in 22.6.2
• Nozomi Networks Guardian: before 22.6.2 — fixed in 22.6.2

How to fix

Upgrade to a fixed version: Nozomi Networks CMC 22.6.2; Nozomi Networks Guardian 22.6.2. Check the vendor advisory for mitigations.

References

• https://security.nozominetworks.com/NN-2023:5-01
• https://security.nozominetworks.com/NN-2023:5-01

Get alerted when CVE-2023-24471 or the next vulnerability affects your stack