NN-2026:20-01
Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0
| Advisory ID | NN-2026:20-01 |
|---|---|
| Topic | Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0 |
| CWE Impact | CWE-671: Lack of Administrator Control over Security |
| Issue date | 2026-09-08 |
| Affects | Guardian, CMC < v26.3.0 Arc < v2.7.0 |
| CVE Name(s) | CVE-2026-33389 |
| CVSS Details | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L |
| CVSS Score | 5.3 (CVSS v4.0) 7.5 (CVSS v3.1) |
| CVE Risk Level | Medium (CVSS v4.0) High (CVSS v3.1) |
| Risk Level for Nozomi customers | High |
Summary
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it.
Impact
A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
Affected Products
Workarounds and Mitigations
N/A
Solutions
Upgrade Guardian/CMC to v26.3.0 or later. Upgrade Arc to v2.7.0 or later.
Modification History
Related Links
Acknowledgements
We thank the following parties for their efforts:
- Stefano Balzarotti of Nozomi Networks for finding this issue during an internal investigation
- Andrea Palanca of Nozomi Networks Product Security team for finding this issue during an internal investigation
Contact
Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com.More contact details on the PSIRT page.