CVE-2023-5253 is a medium severity (CVSS 5.3) missing authentication flaw in the Check Point IoT integration WebSocket of Nozomi Networks Guardian and CMC. An unauthenticated attacker may read limited asset data. Nozomi says versions before 23.3.0 are affected, so upgrade to 23.3.0 or later.
What's affected
The NVD record says a missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC may allow an unauthenticated attacker to obtain assets data. Malicious unauthenticated users with knowledge of the underlying system may be able to extract limited asset information.
The Nozomi advisory NN-2023:12-01, issued on 15 January 2024 and last updated on 19 September 2024, says Guardian and CMC before 23.3.0 are affected, and classifies it as CWE-306. It also lists a CVSS 3.1 vector with low confidentiality impact and no integrity or availability impact, which fits the 5.3 score in the record.
The exposure is information only. No command execution or data change is described.
How to check if you're exposed
Check the software version in the Guardian or CMC web interface, in the system information or about page. Anything before 23.3.0 is affected.
Then check whether the Check Point IoT integration is used on that appliance. The flaw sits in that integration channel, so appliances that do not use it are less likely to be reachable by this path, but verify that against the advisory.
Look at who can reach the appliance on the network. Security monitoring appliances should sit on a management network with limited access.
Review the advisory for platform specific steps and any extra mitigations.
What to do now
- Find all Guardian and CMC appliances and their versions.
- Upgrade to 23.3.0 or later following the Nozomi upgrade guidance.
- Limit network access to the appliance to administrators and integration partners.
- Review whether you need the Check Point IoT integration, and disable it if not.
- Include appliance versions in your regular patch reporting.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. A channel that serves asset data does not ask the caller to prove who it is.
Asset inventories describe what is on an industrial network, and that is useful to anyone planning an attack. The risk is small on its own but it helps reconnaissance. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. Security tools deserve the same patching discipline as the systems they watch.
Quick check
How serious is the data exposure?
The record says limited asset information and the score is medium. It is useful to an attacker for planning, so patch anyway.
Sources
Last reviewed: 19 October 2026.
