Answer in brief
CVE-2026-33389 records a Medium severity (CVSS 5.3) vulnerability in Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0. The current sources do not mark it as known exploited. The current feed maps Nozomi Networks/Arc (generic), Nozomi Networks/CMC (generic), Nozomi Networks/Guardian (generic), Siemens/RUGGEDCOM APE1808 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Nozomi Networks/Arc (generic), Nozomi Networks/CMC (generic), Nozomi Networks/Guardian (generic), Siemens/RUGGEDCOM APE1808 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Nozomi Networks/Arcgeneric | >=0 <2.7.0 | 2.7.0 |
| Nozomi Networks/CMCgeneric | >=0 <26.3.0 | 26.3.0 |
| Nozomi Networks/Guardiangeneric | >=0 <26.3.0 | 26.3.0 |
| Siemens/RUGGEDCOM APE1808generic | >=0 <* | * |
Published upstream
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 8, 2026
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
Quoted source text, attributed separately from HOL analysis.