CVE-2022-0551

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Nozomi Networks	Guardian	>= unspecified, < 22.0.0
Nozomi Networks	CMC	>= unspecified, < 22.0.0
nozominetworks	guardian	< 22.0.0
nozominetworks	cmc	< 22.0.0

References

https://security.nozominetworks.com/NN-2022:2-02Vendor Advisory
https://security.nozominetworks.com/NN-2022:2-02Vendor Advisory

Timeline

Published: Mar 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-05525.9A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-r CVE-2022-05534.6There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted fir CVE-2022-05547.8Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.CVE-2022-05558.4Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions CVE-2022-05567.8A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) CVE-2022-05577.2OS Command Injection in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05585.4Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05599.8Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.CVE-2022-05606.1Open Redirect in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05615.5Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 CVE-2022-05625.5Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4 CVE-2022-05635.5A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" envir