Skip to content
OpenAdvisories
High SSA-911336 5 CVEs

SSA-911336: Multiple Vulnerabilities in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices

Published Oct 13, 2026 · Updated Oct 13, 2026

Vendor: Siemens Product: RUGGEDCOM APE1808

Summary

Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.

Siemens recommends to contact customer support to receive patch and update information.

Vulnerabilities 5

  • High 7.5
    CVE-2026-33389

    Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0

    An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A ma…

    Nozomi Networks CMC Guardian Arc
  • High 7.4
    CVE-2026-33388

    Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

    An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credential…

    Nozomi Networks CMC Guardian
  • Medium 5.4
    CVE-2026-33391

    Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0

    An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web managem…

    Nozomi Networks CMC Guardian
  • Medium 4.6
    CVE-2026-33387

    Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0

    A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be so…

    Nozomi Networks CMC Guardian
  • Low 3.5
    CVE-2026-33920

    Cross-site request forgery in the Guardian/CMC login before 26.3.0

    A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attack…

    Nozomi Networks CMC Guardian

Revision history

  1. #1

    Publication Date

References