CVE-2022-0550: Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-0550?
CVE-2022-0550 is an Improper Input Validation vulnerability in the custom report logo upload functionality in Nozomi Networks Guardian and CMC.
How does CVE-2022-0550 affect Nozomi Networks Guardian and CMC?
CVE-2022-0550 allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges.
What versions of Nozomi Networks CMC are affected by CVE-2022-0550?
Nozomi Networks CMC versions up to exclusive 22.0.0 are affected by CVE-2022-0550.
What versions of Nozomi Networks Guardian are affected by CVE-2022-0550?
Nozomi Networks Guardian versions up to exclusive 22.0.0 are affected by CVE-2022-0550.
How severe is CVE-2022-0550?
CVE-2022-0550 has a severity score of 7.2, which is classified as high.
What is the CWE ID associated with CVE-2022-0550?
The CWE ID associated with CVE-2022-0550 is 20.
How can I fix CVE-2022-0550 in Nozomi Networks Guardian and CMC?
To fix CVE-2022-0550, it is recommended to upgrade Nozomi Networks Guardian and CMC to a version beyond 22.0.0.
Where can I find more information about CVE-2022-0550?
More information about CVE-2022-0550 can be found at the following reference: https://security.nozominetworks.com/NN-2022:2-01