CVE-2026-33389
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L
- CWE
- CWE-671
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Nozomi Networks Arc
Weakness type
Related vulnerabilities
- CVE-2026-31985 — Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.0
- CVE-2025-24024 — Mjolnir v1.9.0 accepts commands from any room
- CVE-2023-20115 — A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000...
- CVE-2022-29163 — Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server
- CVE-2018-13283 — Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client...