Type Vulnerability
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC.
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter
CVE-2026-33387
What this means
This is rated medium severity (5.1 out of 10). There is no confirmed exploitation of it yet.
Full vendor description
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability.
Scoring and exploitation
5.1/ 10
CVSS 4.0 base scoreMedium
Exploitable over the network with a low-privilege account, but only if a user takes an action, such as opening a file or link. Low impact on integrity and availability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredLowPR:L
User interactionPassiveUI:P
Impact
Longer bar: more harm
ConfidentialityNoneVC:N
IntegrityLowVI:L
AvailabilityLowVA:L
- ~0.3% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Not confirmed in the
- Not reported
Weaknesses
CWE-1336
References
2 links from the CVE record, grouped by site.
security.nozominetworks.com1 link
cert-portal.siemens.com1 link