Nozomi Networks vulnerabilities (CVEs)

57 CVEs matched to Nozomi Networks by name in NVD, none on CISA's Known Exploited list.

Back to the Nozomi Networks profile · Alternatives to Nozomi Networks · CVE RSS feed

Exploitation riskProbably exploited

57 of 57 CVEs assessed

confirmed exploited

EPSS ≥ 10%

88%

highest single CVE

4 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2021-26724 ↗EPSS 2.8%LEV ≥88%Probably exploited
OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators…
CVE-2021-26725 ↗EPSS 1.1%LEV ≥52%Probably exploited
Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected syste…
CVE-2020-7049 ↗EPSS 0.9%LEV ≥50%Probably exploited
Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection.

Recent changes

last 90 days

CVE-2022-0551 is now estimated at a 39% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2023-5253 is now estimated at a 13% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2024-0218 is now estimated at a 15% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2021-26725 is now estimated at a 51% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
CVE-2022-0551 is now estimated at a 39% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Low	Unscored	Total
2026	9	8	0	0	21	38
2025	0	3	2	1	0	6
2024	0	1	1	0	0	2
2023	0	6	0	0	0	6
2022	0	2	0	0	0	2
2021	0	2	0	0	0	2
2020	0	1	0	0	0	1

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2021-26724	2.8%	86%
CVE-2026-73172	2.2%	82%
CVE-2025-41269	1.4%	72%
CVE-2025-41270	1.4%	72%
CVE-2025-41272	1.4%	72%
CVE-2025-41274	1.4%	72%
CVE-2025-41275	1.4%	72%
CVE-2025-41276	1.4%	72%
CVE-2025-41277	1.4%	72%
CVE-2026-73163	1.2%	67%

Known CVEs (57)

RSS ⇢

CVE-2026-73177 ↗2026
Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. Th…
CVE-2026-73176 ↗2026
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242…
CVE-2026-73175 ↗2026
Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacen…

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to Nozomi Networks by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-09-23.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.