CVE-2023-29245: SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-19 · updated 2026-06-17
Weakness: CWE-89

Description

A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, may allow an unauthenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application by sending specially crafted malicious network packets. Malicious users with extensive knowledge on the underlying system may be able to extract arbitrary information from the DBMS in an uncontrolled way, alter its structure and data, and/or affect its availability.

Affected products

Nozomi Networks CMC: from 22.6.0 before 22.6.3; from 23.0.0 before 23.1.0 — fixed in 22.6.3, 23.1.0
Nozomi Networks Guardian: from 22.6.0 before 22.6.3; from 23.0.0 before 23.1.0 — fixed in 22.6.3, 23.1.0

How to fix

Upgrade to a fixed version: Nozomi Networks CMC 22.6.3, 23.1.0; Nozomi Networks Guardian 22.6.3, 23.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-29245 or the next vulnerability affects your stack