Technical impact
A denial-of-service flaw exists in Nozomi Networks CMC and Guardian audit logging. The system records user input into audit entries without a size limit, allowing an unauthenticated attacker to submit oversized payloads. When logged, this triggers unbounded allocation of disk space or memory, potentially exhausting these resources and rendering the device inoperable. The weakness is a classic resource-exhaustion vulnerability identified as CWE-770.
Affected Systems
The vulnerability affects all installations of Nozomi Networks CMC and Guardian running any version prior to 26.2.0. Every release before 26.2.0 shares the same audit-logging code path. Based on the description, it is inferred that the issue is triggered when audit logging is enabled, regardless of deployment configuration.
Risk and Exploitability
The CVSS score of 8.7 marks it as high severity, while the EPSS score below 1% indicates a low current likelihood of exploitation. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack likely occurs over the web management interface or API, where an unauthenticated user can submit the large input. Successful exploitation would cause the device to become non-responsive, denying service to all users.
