CVE-2024-0218: Nozomi Networks Guardian DoS Vulnerability

CVE-2024-0218 Overview

CVE-2024-0218 is a denial of service vulnerability in the Nozomi Networks Guardian intrusion detection system. The flaw stems from improper input validation in fields parsed by the Remote Authentication Dial-In User Service (RADIUS) parsing functionality of the IDS module. An unauthenticated attacker can transmit specially crafted malformed network packets to disrupt the IDS engine. Once triggered, the module stops updating nodes, links, and assets, and network traffic is no longer analyzed until the IDS module is restarted. The weakness is tracked under [CWE-1286: Improper Validation of Syntactic Correctness of Input].

Critical Impact
A remote, unauthenticated attacker can halt IDS analysis on Nozomi Networks Guardian by sending malformed RADIUS packets, eliminating monitoring visibility across OT and IoT environments until the module is restarted.

Affected Products

Nozomi Networks Guardian (IDS module with RADIUS parsing functionality)
See vendor advisory NN-2024:1-01 for affected version ranges
Deployments processing RADIUS traffic in monitored network segments

Discovery Timeline

2024-04-10 - CVE-2024-0218 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0218

Vulnerability Analysis

Nozomi Networks Guardian inspects network protocols passively to build asset inventories and identify threats in industrial and IoT networks. The Guardian IDS includes a parser for RADIUS, an authentication protocol commonly observed on enterprise and operational technology networks. The parser fails to validate the syntactic correctness of specific fields within RADIUS packets. When a malformed packet reaches the parser, the IDS module enters a state where it no longer updates its internal model of nodes, links, and assets. Analysis of subsequent network traffic ceases, creating a monitoring blind spot. Recovery requires an administrator to restart the IDS module, during which time visibility into the protected network is lost.

Root Cause

The root cause is improper input validation [CWE-1286] in the RADIUS packet parser. The parser does not adequately enforce syntactic constraints on certain attribute fields before processing them. Malformed structures cause the parsing pipeline to enter an unrecoverable state that blocks subsequent IDS updates.

Attack Vector

The attack vector is the network. No authentication or user interaction is required. An attacker sends crafted RADIUS packets across a network segment monitored by the Guardian sensor. Because Guardian passively analyzes mirrored traffic, the attacker only needs the malformed traffic to traverse a monitored link. The vulnerability does not allow code execution or data exfiltration; the impact is restricted to availability of the IDS analysis function. Technical details of the malformed field structures are not publicly disclosed. See the Nozomi Networks Security Advisory NN-2024:1-01 for vendor-supplied details.

Detection Methods for CVE-2024-0218

Indicators of Compromise

Guardian IDS module ceases to update nodes, links, or asset records despite continued network traffic on monitored interfaces.
Gaps in alert generation or protocol parsing logs that align with the arrival of RADIUS traffic from untrusted sources.
IDS module status transitions to a non-analyzing state without an administrator-initiated change.

Detection Strategies

Monitor Guardian health telemetry for stalled asset and link update counters as an early signal of parser failure.
Correlate RADIUS traffic flows (UDP/1812, UDP/1813) against expected authentication sources and flag traffic from unauthorized endpoints.
Compare expected baseline traffic volume against analyzed-event volume reported by the IDS to detect silent analysis stoppage.

Monitoring Recommendations

Forward Guardian system and module-health logs to a centralized log platform and alert on IDS module restarts or analysis halts.
Track RADIUS protocol anomalies, including unexpected source addresses, malformed attribute lengths, and oversized packets.
Establish a heartbeat check that validates Guardian asset and link counts increment over time during normal operations.

How to Mitigate CVE-2024-0218

Immediate Actions Required

Apply the fixed firmware version published by Nozomi Networks as referenced in advisory NN-2024:1-01.
Restrict RADIUS traffic on monitored segments to known authentication clients and servers using upstream access control lists.
Establish a process to detect and restart the Guardian IDS module promptly if analysis halts.

Patch Information

Nozomi Networks has released updated Guardian firmware that addresses the improper input validation in the RADIUS parser. Refer to the vendor advisory NN-2024:1-01 for the exact fixed version applicable to your deployment and apply it through the standard Guardian update procedure.

Workarounds

Filter or block untrusted RADIUS traffic at network boundaries so it does not reach Guardian-monitored span ports.
Segment the monitored network to limit the set of devices that can originate RADIUS packets toward the sensor.
Implement automated monitoring that restarts the IDS module if asset and link update activity stalls, reducing visibility loss until patching is complete.