CVE-2026-33389

highpriority · track · 0EPSS 0.002 · 6 %ileDENLUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.17% (6th) EPSS
CVSS 7.5 · high
Is it mine?
244 products
Check your exposure
Who says so?
4 sources
cisa_csaf_ot · ncsc_nl · nozomi_psirt · siemens_psirt

EPSS · scored 2026-10-22

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedArcnozomi_psirt

    Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later.

  • FixedCMCnozomi_psirt

    Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later.

  • FixedGuardiannozomi_psirt

    Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later.

  • FixedRUGGEDCOM APE1808siemens_psirt

    Contact customer support to receive patch and update information

  • FixedRUGGEDCOM APE1808cisa_csaf_ot

    Contact customer support to receive patch and update information

  • MitigationArcnozomi_psirt

    N/A

  • MitigationCMCnozomi_psirt

    N/A

  • MitigationGuardiannozomi_psirt

    N/A

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 1.3–7.5

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Lsecondary · Siemens ProductCERT DE
v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Lsecondary · Nozomi Networks PSIRT
v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Lsecondary · NCSC-NL NL
v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Lsecondary · prodsec@nozominetworks.comexploitability 1.6 · impact 5.3
v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:Lsecondary · CISA US
v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · prodsec@nozominetworks.com
v4.01.3lowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-671USCWE-671USCWE-671USCWE-671USCWE-671US
05

affected products (244)

Products and version ranges known to be affected.

showing 20 of 244
06

advisories (4)

Vendor and ecosystem advisories describing this.

  • NCSC-2026-0415Kwetsbaarheden verholpen in Siemens-productenNL2026-10-13csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Desigo, Industrial Plus, RUGGEDCOM, SIMATIC en SIPLUS.

  • NN-2026:20-01Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.02026-09-08csaf · nozomi_psirtUS
  • SSA-911336SSA-911336: Multiple Vulnerabilities in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices2026-10-13csaf · siemens_psirtDE

    Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information.

  • ICSA-26-295-18Siemens RUGGEDCOM APE1808 Devices2026-10-13icsa · cisa_csaf_otUS

    Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information.

07

sources

Which sources assert this record, and when.

cisa_csaf_otncsc_nlnozomi_psirtsiemens_psirtNVDCVE.orgMITRE
published 2026-09-08modified 2026-10-15
08

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan