Vulnerability-Lookup

NN-2026:20-01

Vulnerability from csaf_nozominetworks - Published: 2026-09-08 11:00 - Updated: 2026-09-08 11:00

Summary

Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0

Severity

High

Notes

Risk Level for Nozomi customers: High

CVE-2026-33389

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

CWE-671 - Lack of Administrator Control over Security

Affected products

Fixed 3 products

Product	Identifier	Version	Remediation
Nozomi Networks Guardian 26.3.0 Nozomi Networks / Guardian		26.3.0
Nozomi Networks CMC 26.3.0 Nozomi Networks / CMC		26.3.0
Nozomi Networks Arc 2.7.0 Nozomi Networks / Arc		2.7.0

Known affected 3 products

Product	Version	Remediation
Nozomi Networks Guardian <26.3.0 Nozomi Networks / Guardian	vers:gem/<26.3.0	Mitigation Vendor Fix
Nozomi Networks CMC <26.3.0 Nozomi Networks / CMC	vers:gem/<26.3.0	Mitigation Vendor Fix
Nozomi Networks Arc <2.7.0 Nozomi Networks / Arc	vers:gem/<2.7.0	Mitigation Vendor Fix

Threats

Impact A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.

References

3 references

URL	Category
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CV…	external
https://security.nozominetworks.com/csaf/2026/nn-…	self
https://security.nozominetworks.com/NN-2026:20-01	self

Acknowledgments

Nozomi Networks Stefano Balzarotti

Nozomi Networks Product Security team Andrea Palanca

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "HIGH"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "other",
        "text": "High",
        "title": "Risk Level for Nozomi customers"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com",
      "name": "Nozomi Networks Product Security",
      "namespace": "https://security.nozominetworks.com/psirt"
    },
    "title": "Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0",
    "tracking": {
      "aliases": [
        "CVE-2026-33389"
      ],
      "current_release_date": "2026-09-08T11:00:00.000Z",
      "id": "NN-2026:20-01",
      "initial_release_date": "2026-09-08T11:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-09-08T11:00:00.000Z",
          "number": "1",
          "summary": "Initial revision"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:gem/\u003c26.3.0",
                "product": {
                  "name": "Nozomi Networks Guardian \u003c26.3.0",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "26.3.0",
                "product": {
                  "name": "Nozomi Networks Guardian 26.3.0",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Guardian"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:gem/\u003c26.3.0",
                "product": {
                  "name": "Nozomi Networks CMC \u003c26.3.0",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "26.3.0",
                "product": {
                  "name": "Nozomi Networks CMC 26.3.0",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "CMC"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:gem/\u003c2.7.0",
                "product": {
                  "name": "Nozomi Networks Arc \u003c2.7.0",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version",
                "name": "2.7.0",
                "product": {
                  "name": "Nozomi Networks Arc 2.7.0",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "Arc"
          }
        ],
        "category": "vendor",
        "name": "Nozomi Networks"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Stefano Balzarotti"
          ],
          "organization": "Nozomi Networks",
          "summary": "finding this issue during an internal investigation"
        },
        {
          "names": [
            "Andrea Palanca"
          ],
          "organization": "Nozomi Networks Product Security team",
          "summary": "finding this issue during an internal investigation"
        }
      ],
      "cve": "CVE-2026-33389",
      "cwe": {
        "id": "CWE-671",
        "name": "Lack of Administrator Control over Security"
      },
      "discovery_date": "2026-09-08T11:00:00.000Z",
      "ids": [
        {
          "system_name": "Nozomi Networks Security Advisory ID",
          "text": "NN-2026:20-01"
        }
      ],
      "notes": [
        {
          "category": "summary",
          "text": "An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host\u0027s identity, and no option was provided to enable it.",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002",
          "CSAFPID-0004",
          "CSAFPID-0006"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "Mitre CVE entry",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33389"
        },
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://security.nozominetworks.com/csaf/2026/nn-2026_20-01.json"
        },
        {
          "category": "self",
          "summary": "Human-readable advisory.",
          "url": "https://security.nozominetworks.com/NN-2026:20-01"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "N/A",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device\u0027s data and to disrupt its operations."
        }
      ],
      "title": "Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0"
    }
  ]
}

CVE-2026-33389 (GCVE-0-2026-33389)

Vulnerability from cvelistv5 – Published: 2026-09-08 13:55 – Updated: 2026-09-08 14:19

Title

Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0

Summary

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 14:19 UTC

CWE

CWE-671 - Lack of Administrator Control over Security

Assigner

Nozomi mitre root

References

1 reference

URL	Tags
https://security.nozominetworks.com/NN-2026:20-01

Impacted products

3 products

Vendor	Product	Version
Nozomi Networks	Guardian	Affected: 0 , < 26.3.0 (semver) cpe:2.3:a:nozomi_networks:guardian::::::::
Nozomi Networks	CMC	Affected: 0 , < 26.3.0 (semver) cpe:2.3:a:nozomi_networks:cmc::::::::
Nozomi Networks	Arc	Affected: 0 , < 2.7.0 (semver) cpe:2.3:a:nozomi_networks:arc::::::::

Date Public

2026-09-08 07:00

Credits

This issue was found by Stefano Balzarotti of Nozomi Networks and Andrea Palanca of Nozomi Networks Product Security team during an internal investigation.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33389",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T14:19:40.637992Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T14:19:48.707Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Guardian",
          "vendor": "Nozomi Networks",
          "versions": [
            {
              "lessThan": "26.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CMC",
          "vendor": "Nozomi Networks",
          "versions": [
            {
              "lessThan": "26.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Arc",
          "vendor": "Nozomi Networks",
          "versions": [
            {
              "lessThan": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nozomi_networks:guardian:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "26.3.0",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nozomi_networks:cmc:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "26.3.0",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nozomi_networks:arc:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.7.0",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was found by Stefano Balzarotti of Nozomi Networks and Andrea Palanca of Nozomi Networks Product Security team during an internal investigation."
        }
      ],
      "datePublic": "2026-09-08T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host\u0027s identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device\u0027s data and to disrupt its operations."
            }
          ],
          "value": "An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host\u0027s identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device\u0027s data and to disrupt its operations."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-671",
              "description": "CWE-671 Lack of Administrator Control over Security",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T13:55:16.115Z",
        "orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
        "shortName": "Nozomi"
      },
      "references": [
        {
          "url": "https://security.nozominetworks.com/NN-2026:20-01"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later.\u003cbr\u003e"
            }
          ],
          "value": "Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
    "assignerShortName": "Nozomi",
    "cveId": "CVE-2026-33389",
    "datePublished": "2026-09-08T13:55:16.115Z",
    "dateReserved": "2026-03-19T11:28:43.172Z",
    "dateUpdated": "2026-09-08T14:19:48.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

NN-2026:20-01

CVE-2026-33389 (GCVE-0-2026-33389)

Tags

Sightings

Nomenclature