Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
CVE-2026-33389
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-33389
Guardian
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
CMC
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Arc
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Nozomi Networks",
"product": "Guardian",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.3.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Nozomi Networks",
"product": "CMC",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.3.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Nozomi Networks",
"product": "Arc",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.7.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-33389
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28331 · Revision 1
- Added to Heist Feed
- Publisher date