Nozomi Networks Arc
7 CVEs affecting Nozomi Networks Arc. Latest disclosed: 2026-08-11. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5938 | High | 8.0 | 2024-05-15 | Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attack… |
CVE-2023-5936 | High | 7.8 | 2024-05-15 | On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in the system may be a… |
CVE-2023-5935 | High | 7.4 | 2024-05-15 | When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface lacks authenticatio… |
CVE-2025-40896 | Medium | 6.5 | 2026-03-04 | The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-middle attack and int… |
CVE-2026-33922 | Medium | 6.0 | 2026-08-11 | A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input param… |
CVE-2026-33921 | Medium | 5.2 | 2026-08-11 | The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of t… |
CVE-2023-5937 | Low | 3.8 | 2024-05-15 | On Windows systems, the Arc configuration files resulted to be world-readable. This can lead to information disclosure by local attackers, via exfiltration… |