Nozomi Arc Pre-Auth Driver Access Control Flaw Leading to Traffic Capture (CVE-2026-33921)

Vulnerability Overview Vulnerability ID: NN-2026:14-01 Description: The Npcap driver is installed on Windows systems without restricting administrative access, making the driver accessible to all local users rather than being limited to administrators only. CWE Impact: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer (Note: The original Chinese text cites "CWE-119: 初始化资源时使用不安全默认值" which translates literally to "Using insecure defaults when initializing resources," but CWE-119 is actually "Improper Restriction of Operations within the Bounds of a Memory Buffer." However, based on the description of access control failure, CWE-250 or CWE-284 might be more semantically appropriate in a real-world context. Nevertheless, as a translator, I must faithfully translate the provided text. The provided Chinese text explicitly links CWE-119 to "insecure defaults during initialization." I will translate the text exactly as provided, mapping CWE-119 to the description given in the source.) Correction: Looking closely at standard CWE mappings, CWE-119 is "Improper Restriction of Operations within the Bounds of a Memory Buffer". The Chinese text says "CWE-119: 初始化资源时使用不安全默认值" (Using insecure defaults when initializing resources). This is a mismatch in the source text between the CWE ID and its description. As a professional translator, I should translate the text as it appears. Re-evaluation: The prompt asks for a professional translation. I will translate the text faithfully. CWE Impact: CWE-119: Using insecure defaults when initializing resources Publication Date: 2026-08-11 Affected Products: Arc < v2.7.0 CVE Name: CVE-2026-33921 CVSS Details: - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Scores: - 4.9 (CVSS v4.0) - 5.2 (CVSS v3.1) CVE Risk Level: Medium (CVSS v4.0) Nozomi Customer Risk Level: Medium Impact Scope Local users without administrative privileges can use the Npcap driver to capture traffic arriving at the host. This leads to the leakage of data from the host and other systems on the same network segment, and allows the sending of arbitrary raw packets within that network segment. Remediation Temporary Mitigation: Reinstall Npcap and enable the "Restrict Npcap driver access to Administrators" option. Solution: Upgrade Arc to version v2.7.0 or higher. Change History 2026-08-11: Initial revision Related Links Mitre CVE Entry Acknowledgements Thanks to Stefano Balzarotti of Nozomi Networks for discovering this issue during an internal investigation. Contact Information The Nozomi Networks Product Security Team can be contacted at prodsec@nozominetworks.com. See the PSIRT page for more contact details.

Goal Reached Thanks to every supporter — we hit 100%!

Nozomi Arc Pre-Auth Driver Access Control Flaw Leading to Traffic Capture (CVE-2026-33921)