The vulnerability in Nozomi Networks Guardian's Smart Polling functionality stems from the lack of proper validation of the remote host's identity during encrypted connections. The system establishes connections without verifying the certificate or host key of the target device, and no option exists to enable such validation. Consequently, a man-in-the-middle attacker positioned between a sensor and a polled device can impersonate the device during polling sessions, intercepting credentials. These credentials can be replayed to gain unauthorized access to the device or other devices using the same credentials, enabling data tampering and disruption of device operations. The CVSS 4.0 base score is 5.3, indicating medium severity. There is no known exploit in the wild, and no patch or remediation level has been published by the vendor as of the data provided.

An attacker capable of man-in-the-middle positioning can intercept and replay credentials used by the Smart Polling feature to access devices. This can lead to unauthorized access to devices, manipulation of device data, and disruption of device operations. The vulnerability compromises the confidentiality and integrity of communications between the sensor and polled devices. The impact is limited by the need for the attacker to be positioned between the communicating parties and to successfully intercept the polling session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider network-level protections to prevent man-in-the-middle positioning, such as secure network segmentation and monitoring for suspicious network activity. Nozomi Networks has not provided an option to enable proper certificate or host key validation in the affected functionality, so mitigation options within the product are limited.