This vulnerability (CWE-306) in Nozomi Networks Guardian allows unauthenticated access to the SSH keys synchronization endpoint. Because the endpoint lacks authentication, an attacker can send requests to obtain user and group information along with uploaded public SSH keys. The CVSS 4.0 base score is 6.9, reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is provided, and the product is not a cloud service.

An attacker can obtain sensitive information about users and their public SSH keys without authentication. This information disclosure could facilitate further targeted attacks or unauthorized access attempts. However, the vulnerability does not allow direct system compromise or integrity impact by itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the SSH keys synchronization endpoint to trusted users only if possible.