Full Report
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Nozomi Guardian/CMC on RUGGEDCOM APE1808
## CVE Details
- **CVE-2026-33389** | CVSS v3.1: **7.5 (High)** | CWE-671: Lack of Admin Control over Security
- **CVE-2026-33388** | CVSS v3.1: **7.4 (High)** | CWE-863: Incorrect Authorization
- **CVE-2026-33391** | CVSS v3.1: **5.4 (Medium)** | CWE-863: Incorrect Authorization
- **CVE-2026-33387** | CVSS v3.1: **4.6 (Medium)** | CWE-1336: Template Injection
- **CVE-2026-33920** | CVSS v3.1: **3.5 (Low)** | CWE-352: Cross-Site Request Forgery (CSRF)
## Affected Systems
- **Products:** RUGGEDCOM APE1808 (Application Hosting Platform)
- **Versions:** All versions running Nozomi Guardian/CMC.
- **Configurations:** Systems utilizing Dashboards, Credentials Manager, Smart Polling, or Web Management Interfaces.
## Vulnerability Description
This advisory addresses five distinct flaws within the Nozomi Guardian/CMC software hosted on Siemens RUGGEDCOM devices:
* **Improper Validation (CVE-2026-33389):** Smart Polling fails to validate remote host identities during encrypted connections, enabling Man-in-the-Middle (MitM) attacks.
* **Authorization Flaws (CVE-2026-33388 & CVE-2026-33391):** Insufficient privilege validation allows low-privileged users to manipulate the Credentials Manager and Smart Polling discovery configurations.
* **Template Injection (CVE-2026-33387):** Improper input validation in the Dashboards functionality allows for malicious payload execution in a victim's browser context.
* **CSRF (CVE-2026-33920):** Missing anti-CSRF token validation in login processes allows attackers to force victims to authenticate under the attacker's session.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; PoC status not specified.
- **Complexity:** Ranges from **Low** (Access Control/CSRF) to **High** (MitM for Smart Polling).
- **Attack Vector:** **Network** (All identified vulnerabilities are remotely exploitable).
## Impact
- **Confidentiality:** **High** (MitM interception of credentials; unauthorized viewing of credential entries).
- **Integrity:** **Low to Moderate** (Unauthorized modification of configurations, audit trail corruption, and data tampering).
- **Availability:** **Low to Moderate** (Potential disruption of authentication services and asset visibility).
## Remediation
### Patches
Siemens has not released a direct public download for these patches.
- **Action:** Customers must **contact Siemens customer support** to receive specific patch and update information for their RUGGEDCOM APE1808 deployment.
### Workarounds
- **Network Segmentation:** Protect network access to devices with appropriate physical and logical mechanisms.
- **Operational Guidelines:** Configure the environment according to Siemens’ operational guidelines for Industrial Security.
- **Social Engineering Awareness:** Caution users against importing unverified Dashboard templates (mitigates CVE-2026-33387).
## Detection
- **Indicators of Compromise:** Unusual modifications to Smart Polling configurations, unexpected deletions in the Credentials Manager, or audit logs showing users logged into incorrect accounts.
- **Detection Methods:** Monitor network traffic for unauthorized MitM activity between sensors and polled devices; audit Nozomi Guardian user activity logs for privilege escalation attempts.
## References
- **Siemens Security Advisory:** hxxps://cert-portal.siemens[.]com/productcert/html/ssa-911336.html
- **Siemens Industrial Security:** hxxps://www.siemens[.]com/industrialsecurity
- **Nozomi Networks Security Alerts:** hxxps://security.nozominetworks[.]com/alerts/