What’s Vulnerable › Vulnerabilities
CVE-2023-24477: Session Fixation in Guardian/CMC before 22.6.2
- Severity: high (CVSS 7.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-08-09 · updated 2026-06-17
- Weakness: CWE-384
Description
In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.
Affected products
- Nozomi Networks CMC: before 22.6.2 — fixed in 22.6.2
- Nozomi Networks Guardian: before 22.6.2 — fixed in 22.6.2
How to fix
Upgrade to a fixed version: Nozomi Networks CMC 22.6.2; Nozomi Networks Guardian 22.6.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2023-24477 or the next vulnerability affects your stack