Description
A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Nozomi Networks | Guardian | < 25.2.0 | 25.2.0 |
| Nozomi Networks | CMC | < 25.2.0 | 25.2.0 |
Advisories 2
- ICSA-25-226-09 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · Jan 14, 2026
- SSA-978177 SSA-978177: Vulnerability in Nozomi Guardian/CMC Before 25.4.0 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Jan 13, 2026