CVE-2024-13089 Details
Description
An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. Users with administrative privileges may upload update packages to upgrade the versions of Nozomi Networks Guardian and CMC. While these updates are signed and their signatures are validated prior to installation, an improper signature validation check has been identified. This issue could potentially enable users to execute commands remotely on the appliance, thereby impacting confidentiality, integrity, and availability.
A command injection vulnerability has been identified in the update functionality of Nozomi Networks Guardian and CMC, affecting versions prior to 24.6.0. This vulnerability allows authenticated administrators to execute arbitrary operating system commands. While update packages are signed and their signatures are validated before installation, an improper signature validation check has been discovered. This flaw could enable remote command execution on the appliance, impacting its confidentiality, integrity, and availability.
Users are advised to upgrade to version 24.6.0 or later. Only install update packages from trusted sources.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2025CISA-ADP
Assessed Jun 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.nozominetworks.com/NN-2025:1-01 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nozomi Networks Guardian | < 24.6.0 (semver) |
CPE
Remediation
| |
| Nozomi Networks CMC | < 24.6.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2025 | New CVE Received | [email protected] |