What’s Vulnerable › Vulnerabilities

CVE-2023-5253: Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-15 · updated 2026-06-17
• Weakness: CWE-306

Description

A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication. Malicious unauthenticated users with knowledge on the underlying system may be able to extract limited asset information.

Affected products

• Nozomi Networks CMC: before 23.3.0 — fixed in 23.3.0
• Nozomi Networks Guardian: before 23.3.0 — fixed in 23.3.0

How to fix

Upgrade to a fixed version: Nozomi Networks CMC 23.3.0; Nozomi Networks Guardian 23.3.0. Check the vendor advisory for mitigations.

References

• https://security.nozominetworks.com/NN-2023:12-01
• https://security.nozominetworks.com/NN-2023:12-01

Get alerted when CVE-2023-5253 or the next vulnerability affects your stack