Summary
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information.
The following versions of Siemens RUGGEDCOM APE1808 Devices are affected:
- RUGGEDCOM APE1808 vers:all/* (CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, CVE-2026-33920)
CVSS
Vendor
Equipment
v3 7.5
Siemens
RUGGEDCOM APE1808
4 Vulnerabilities
Improper Neutralization of Special Elements Used in a Template Engine, Incorrect Authorization, Lack of Administrator Control over Security, Cross-Site Request Forgery (CSRF)
Background
- Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
- Countries/Areas Deployed: Worldwide
- Company Headquarters Location: Germany
Vulnerabilities
Expand All +
CVE-2026-33387
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard. When the victim views or imports the dashboard, the payload executes in their browser context, allowing the attacker to modify application data or disrupt application availability.
Read More
1 Affected Product
RUGGEDCOM APE1808 with Nozomi Guardian/CMC
Product Status: known_affected
Remediations
Vendor fix
Contact customer support to receive patch and update information
Additional Metrics
Relevant CWE: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
CVSS Version
Base Score
Base Severity
Vector String
3.1
4.6
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVE-2026-33388
An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials.
Read More
2 Affected Products
RUGGEDCOM APE1808 with Nozomi Guardian/CMC
Product Status: known_affected
Remediations
Vendor fix
Contact customer support to receive patch and update information
RUGGEDCOM APE1808 with Nozomi Guardian/CMC
Product Status: known_affected
Remediations
Vendor fix
Contact customer support to receive patch and update information
Additional Metrics
Relevant CWE: CWE-863 Incorrect Authorization
CVSS Version
Base Score
Base Severity
Vector String
3.1
7.4
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVE-2026-33389
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
Read More
3 Affected Products
RUGGEDCOM APE1808 with Nozomi Guardian/CMC
Product Status: known_affected
Remediations
Vendor fix
Contact customer support to receive patch and update information
RUGGEDCOM APE1808 with Nozomi Guardian/CMC
Product Status: known_affected
Remediations
Vendor fix
Contact customer support to receive patch and update information
RUGGEDCOM APE1808 with Nozomi Guardian/CMC
Product Status: known_affected
Remediations
Vendor fix
Contact customer support to receive patch and update information
Additional Metrics
Relevant CWE: CWE-671 Lack of Administrator Control over Security
CVSS Version
Base Score
Base Severity
Vector String
3.1
7.5
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L
CVE-2026-33391
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: