Arc vulnerabilities
4 known vulnerabilities in Arc from Nozomi Networks. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Guardian: Lack of Administrator Control over Security
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man
- 8.0 High severity
Arc: Improper Limitation of a Pathname to a Restricted Directory
Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks. An administrator able to provide tampered archives to be processed by the affected versions of Arc
- 7.8 High severity
Arc: Incorrect Permission Assignment for Critical Resource
On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in the system may be able to trigger arbitrary code execution with root privileges.
- 7.4 High severity
Arc: Missing Authentication for Critical Functionality
When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface lacks authentication and may thus be abused by a local attacker or malware running on the machine itself. A malicious lo