Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-33389— Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0

Quick assessment

Affected
Nozomi Networks Guardian
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在“智能轮询”功能中发现了一个证书/主机密钥验证不当的漏洞。该功能在与目标设备建立加密连接时，未验证远程主机的身份，且未提供任何选项来启用该验证。位于传感器与被轮询设备之间的中间人攻击者，可以在轮询会话期间冒充该设备并截获通信内容，包括用于访问该设备的凭据。攻击者随后可以重放这些截获的凭据，直接对该设备本身或共享相同凭据的其他设备进行身份验证，从而访问并篡改设备数据，并干扰其正常运行。

CVSS 7.5 · High

Affected Version Matrix 3

VendorProduct Version RangeStatus
Nozomi Networks Arc < 2.7.0 affected
Nozomi Networks CMC < 26.3.0 affected
Nozomi Networks Guardian < 26.3.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-33389

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0
Source: CVE Program / CVE List V5
Vulnerability Description
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
缺乏对安全的管理控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Nozomi Networks Guardian 0 ~ 26.3.0 -
Nozomi Networks CMC 0 ~ 26.3.0 -
Nozomi Networks Arc 0 ~ 2.7.0 -

II. Public POCs for CVE-2026-33389

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-33389

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-33389 (1)

Same Patch Batch · Nozomi Networks · 2026-09-08 · 5 CVEs total

CVE-2026-33388 7.4 HIGH Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0
CVE-2026-33391 5.4 MEDIUM Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0
CVE-2026-33387 4.6 MEDIUM Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0
CVE-2026-33920 3.5 LOW Cross-site request forgery in the Guardian/CMC login before 26.3.0

IV. Related Vulnerabilities

Same product: Guardian
Same vendor: Nozomi Networks
Same weakness: CWE-671

V. Comments for CVE-2026-33389

No comments yet

Leave a comment