Type Vulnerability
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC.
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter
CVE-2026-33920
What this means
This is rated medium severity (5.1 out of 10). There is no confirmed exploitation of it yet.
Full vendor description
A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail.
Scoring and exploitation
5.1/ 10
CVSS 4.0 base scoreMedium
Exploitable over the network with a low-privilege account, but only if a user takes an action, such as opening a file or link. Low impact on integrity.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredLowPR:L
User interactionPassiveUI:P
Impact
Longer bar: more harm
ConfidentialityNoneVC:N
IntegrityLowVI:L
AvailabilityNoneVA:N
- ~0.1% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Not confirmed in the
- Not reported
Weaknesses
CWE-352
References
2 links from the CVE record, grouped by site.
security.nozominetworks.com1 link
cert-portal.siemens.com1 link