PT-2023-5522 · Nozomi · Nozomi Guardian+1

Stefano Libero · Published 2023-08-09 · Updated 2024-09-20 · CVE-2023-24015

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nozomi Guardian and Nozomi Central Management Console (CMC) (affected versions not specified)

Description A partial Denial of Service (DoS) issue has been identified in the Reports section. This issue can be exploited by a malicious authenticated user who forces a report to be saved with its name set as null, specifically by setting the name variable to null. The exploitation of this issue may cause the reports section to be partially unavailable for subsequent attempts to use it, with the report list appearing to be stuck on loading. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

CWE-1286

Related Identifiers

BDU:2023-06172

CVE-2023-24015

Affected Products

Nozomi Central Management Console

Nozomi Guardian

References · 9

• https://security.nozominetworks.com/NN-2023:6-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06172 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24015 · Security Note
• https://t.me/cvenotify/56067 · Telegram Post
• https://t.me/cvenotify/56080 · Telegram Post
• https://twitter.com/NUYTSTECH/status/1691449813370597377 · Twitter Post
• https://t.me/cvenotify/95402 · Telegram Post
• https://t.me/cvenotify/81152 · Telegram Post