CVE-2026-33389: CWE-671 Lack of Administrator Control over Security in Nozomi Networks Guardian

This vulnerability (CWE-671) in Nozomi Networks Guardian's Smart Polling functionality arises from improper certificate/host key validation. The system establishes encrypted connections to target devices but does not verify the remote host's identity, and no option exists to enable such validation. Consequently, an attacker positioned between a sensor and a polled device can impersonate the device during polling sessions, intercepting communication and credentials. These credentials can be replayed to authenticate against the device or other devices using the same credentials, enabling unauthorized access and potential tampering or disruption.

An attacker capable of man-in-the-middle interception can impersonate polled devices and capture credentials used for authentication. This can lead to unauthorized access to devices, data tampering, and operational disruption. The vulnerability affects confidentiality and integrity of communications between sensors and devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Nozomi Networks advisories for updates. Until a fix is available, consider network-level mitigations such as restricting access between sensors and devices or using external means to verify device identities.