Type Vulnerability
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC.
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter
CVE-2026-33391
What this means
This is rated medium severity (5.3 out of 10). There is no confirmed exploitation of it yet.
Full vendor description
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network.
Scoring and exploitation
5.3/ 10
CVSS 4.0 base scoreMedium
Exploitable over the network with a low-privilege account, and no one has to click or open anything. Low impact on integrity and availability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredLowPR:L
User interactionNoneUI:N
Impact
Longer bar: more harm
ConfidentialityNoneVC:N
IntegrityLowVI:L
AvailabilityLowVA:L
- ~0.4% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Not confirmed in the
- Not reported
Weaknesses
CWE-863
References
2 links from the CVE record, grouped by site.
security.nozominetworks.com1 link
cert-portal.siemens.com1 link