Anyone running a Siemens RUGGEDCOM APE1808 with Nozomi Guardian/CMC should contact Siemens customer support. All versions are affected by five newly listed vulnerabilities, and the only remedy the advisory gives is to ask support for patch and update information.
The flaws originate in Nozomi's software, which Nozomi Networks disclosed. Siemens then listed its own hardware as affected. The five CVEs span four weakness types and score from 3.5 to 7.5 on the 10-point CVSS scale, a standard severity rating. The vendor equipment score is 7.5.
- CVE-2026-33389 (7.5, high): the Smart Polling feature opened encrypted connections without checking the remote device's identity, and offered no setting to turn that check on. An attacker positioned between a sensor and a polled device could impersonate it and capture the login credentials.
- CVE-2026-33388 (7.4, high): a low-privilege user can edit or delete entries in the Credentials Manager, which could break authentication for dependent devices or indirectly expose credentials.
- CVE-2026-33391 (5.4, medium): a limited user can change the Smart Polling discovery settings and degrade asset visibility.
- CVE-2026-33387 (4.6, medium): a malicious dashboard can run code in a victim's browser.
- CVE-2026-33920 (3.5, low): a login CSRF flaw (a trick that makes a victim act under someone else's session) lets an attacker's account take the blame for the victim's actions, which corrupts the audit trail.
The pattern matters more than any one score. Most of these need a valid account, so they are less a front-door break-in than a way to turn a modest foothold into something larger. The worst of them concerns credentials: a monitoring tool that polls many devices holds keys to many devices, and the advisory notes captured logins can be replayed against other devices that share them. Shared passwords turn one intercepted session into several compromised assets.
The advisory lists deployment in critical manufacturing, transportation, energy, healthcare, financial services and government facilities, worldwide. It does not say any of the flaws are being exploited, and it gives no patch timeline. Siemens' general advice is to restrict network access to the devices and follow its industrial security guidelines. For a tool meant to give operators visibility, three of the five flaws can blind or mislead them.