Veille CVE

Recherche « Nozomi Networks Arc »

6 CVE

Critique 0 Élevée 3 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Nozomi Networks Arc » ✕
  1. CVE-2026-73171 8.6 Élevée

    Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS

    Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.

  2. CVE-2026-33389 7.5 Élevée

    Nozomi Networks Guardian · Nozomi Networks CMC · Nozomi Networks Arc · Siemens RUGGEDCOM APE1808

    An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.

  3. CVE-2026-33922 6.0 Moyenne

    Nozomi Networks Arc

    A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.

  4. CVE-2026-33921 5.2 Moyenne

    Nozomi Networks Arc

    The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to capture the traffic reaching the host, which discloses information belonging both to the host and to other systems on the same network segment, and to send arbitrary raw packets on that segment.

  5. CVE-2026-33390 8.1 Élevée

    Nozomi Networks Guardian · Nozomi Networks CMC · Siemens RUGGEDCOM APE1808 · Nozominetworks cmc

    An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

  6. CVE-2025-40903 4.8 Moyenne

    Nozomi Networks Guardian · Nozomi Networks CMC · Siemens RUGGEDCOM APE1808 · Nozominetworks cmc

    A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious restore schedule containing HTML tags. When a victim views the affected schedule, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.