CVE-2026-33389
highPriorität · verfolgen · 0EPSS 0.002 · 6. PerzentilDENLUSEPSS · bewertet 2026-10-22
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenArcnozomi_psirt
Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later.
- BehobenCMCnozomi_psirt
Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later.
- BehobenGuardiannozomi_psirt
Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later.
- BehobenRUGGEDCOM APE1808siemens_psirt
Contact customer support to receive patch and update information
- BehobenRUGGEDCOM APE1808cisa_csaf_ot
Contact customer support to receive patch and update information
- MitigationArcnozomi_psirt
N/A
- MitigationCMCnozomi_psirt
N/A
- MitigationGuardiannozomi_psirt
N/A
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 1.3–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (244)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2026-0415Kwetsbaarheden verholpen in Siemens-productenNL2026-10-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Desigo, Industrial Plus, RUGGEDCOM, SIMATIC en SIPLUS.
- NN-2026:20-01Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.02026-09-08csaf · nozomi_psirtUS
- SSA-911336SSA-911336: Multiple Vulnerabilities in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices2026-10-13csaf · siemens_psirtDE
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information.
- ICSA-26-295-18Siemens RUGGEDCOM APE1808 Devices2026-10-13icsa · cisa_csaf_otUS
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (2) nvd
Externe Belege — Patches, Meldungen, Analysen.
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan