TL;DR: The Windows installer for Nozomi Arc before v2.7.0 deployed the Npcap packet capture driver without enabling its administrator-only access restriction. Any local user on the host, regardless of privilege level, could capture network traffic and inject raw packets onto the network segment. Fixed in version 2.7.0.

What happened

Npcap is the Windows packet capture library that replaced WinPcap. It powers tools like Wireshark and Nmap on modern Windows systems. The driver has a configuration option called restrict_npcap that, when enabled, limits access to administrators only. When left at the default (disabled), any local user on the machine can open the driver and capture packets.

Nozomi Arc's Windows installer deployed Npcap and left this option at its insecure default value. The result: any local user on an Arc host could use the Npcap driver to capture all traffic reaching that host. That includes traffic belonging to the Arc appliance itself and traffic from other systems on the same network segment. The attacker could also send arbitrary raw packets on that segment, enabling spoofing, injection, and lateral network attacks.

The exposure persists for the lifetime of the Npcap installation. It does not require exploitation of a separate vulnerability. Any account that can log into the Windows host locally or via remote desktop gains this capability immediately.

Who is affected

Nozomi Arc is a security monitoring platform for industrial control systems and operational technology networks. Nozomi Networks sells Arc to thousands of enterprise customers protecting critical infrastructure: power grids, water treatment plants, oil and gas pipelines, pharmaceutical manufacturing lines, and factory automation systems. The Windows variant of Arc runs on dedicated appliances or virtual machines deployed inside industrial network segments where it can observe OT traffic.

Every Arc deployment on Windows before version 2.7.0 is affected. Environments where multiple users or service accounts share access to the Arc host are at the highest risk. In those cases, a low-privilege account that should have no ability to see or manipulate network traffic gains full packet capture and raw send capability across the industrial segment.

What to do

Upgrade to Arc v2.7.0 or later. The installer in 2.7.0 enables the restrict_npcap option, limiting driver access to administrators.

If you cannot upgrade right away, manually reconfigure Npcap. Run the Npcap installer in repair mode and select the "Restrict Npcap driver's access to Administrators only" checkbox. Alternatively, modify the Npcap service registry to enforce the restriction. Verify by confirming that a standard user account cannot open the Npcap device.

Audit which local accounts exist on Arc Windows hosts. Remove or disable any non-essential accounts that do not need interactive logon access.

Why it matters

Industrial networks are designed around segmentation. OT traffic in a refinery or substation should only be visible to the systems that need to monitor it. An insecure packet capture driver on a security appliance breaks that assumption, giving any local user a window into every packet on the segment.

The raw packet injection capability is worse. An attacker who can send crafted packets into an industrial network segment can spoof PLC communications, inject false sensor readings, or disrupt safety-critical protocols. In OT environments, that translates directly to physical risk: equipment damage, process shutdown, or safety system interference.

This is a supply chain configuration failure. Nozomi shipped a third-party driver with an insecure default, and every customer who deployed Arc on Windows inherited that exposure without knowing it. The fix is simple, but the exposure window may have lasted months or years for long-running deployments.

References

• hol.org CVE record
• Npcap project
• Nozomi Networks