CVE-2026-33391

MEDIUM 5.3 ALL-YEARS

Published 2026-09-08 · Last modified 2026-10-15 · Nozomi · NVD: Awaiting Analysis

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration. This allows the attacker to disrupt the visibility of assets in the monitored network.

LIMITED SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 29th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

5.3CVSS 4.0 · MEDIUM · CNA

ConfidentialityNone
IntegrityLow
AvailabilityLow

What an attacker needs

✓Access: Reachable over the network — no local access needed
⚠Privileges: Requires a low-privilege account
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable
✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Nozomi Networks Siemens

Products Guardian Cmc Ruggedcom Ape1808

Weakness (CWE)

CWE-863: Incorrect authorization

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References and research data (JSON)

All CVSS metrics

MEDIUM 5.3 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
MEDIUM 5.4 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
MEDIUM 5.3 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MEDIUM 5.4 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

Advisories

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72788 ADVISORYEUVD · EUVD-2026-72788

Technical & other

https://security.nozominetworks.com/NN-2026:17-01CVE record · Nozomi · Updated 2026-09-08T13:56:38.077Z
NVD · CVE-2026-33391 · Updated 2026-10-15T02:19:21.540
https://cert-portal.siemens.com/productcert/html/ssa-911336.htmlCVE record · siemens-SADP · Updated 2026-10-15T01:18:23.954Z
NVD · CVE-2026-33391 · Updated 2026-10-15T02:19:21.540

Sources: NVD · CVE.org · All sources and attribution · EPSS