Nozomi Remote Collector CVE-2026-31985

Exploitation requires that the Remote Collector was set up with an upstream Guardian or CMC through the n2os-tui interface - that specific configuration path is what generates the TLS-verification-disabled config, and there is no operator option to enable verification. The attacker must additionally hold an active man-in-the-middle / on-path position on the network between the Remote Collector and the Guardian or CMC (reflected as AT:P in the CVSS 4.0 vector); this is the primary limiting factor, since no valid MitM position means no exploitation. No authentication on the Collector is needed (PR:N) and no user interaction is required (UI:N), but the need for network path control makes this a targeted rather than opportunistic attack, and Collectors on fully isolated, trusted management links are not realistically exposed.

The vendor CVSS 4.0 base score is 8.3 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N and impacts VC:L/VI:H/VA:L, meaning the standout risk is integrity (VI:H) - spoofed asset and vulnerability data injected into the monitoring backbone - rather than confidentiality or availability. The AT:P (Attack Requirements: Present) metric is the key limiter: exploitation requires the attacker to first achieve a man-in-the-middle position on the Collector-to-Guardian/CMC path, so this is not a trivially automatable internet-wide bug despite AV:N. EPSS is not provided, KEV status is NO, and no POC is referenced, so exploitation is conditional and situational rather than confirmed or widespread. The realistic priority is elevated for OT environments where the monitoring plane spans untrusted network segments, but the MitM prerequisite means it is a targeted-adversary concern rather than a mass-exploitation event; a compromised monitoring integrity signal is especially serious because it can mask real attacks or trigger false ones.

An attacker who gains a foothold on a network segment between the Remote Collector and the Guardian/CMC (e.g., via ARP spoofing, a rogue switch/router, or a compromised intermediate host) transparently intercepts the TLS session that skips certificate validation. Because the Collector accepts any presented certificate, the attacker impersonates the Guardian, harvests the sync token, and injects fabricated asset and vulnerability data - or drops legitimate telemetry - to poison the OT monitoring picture. No public exploit code is identified, but the attack uses standard, well-understood MitM techniques.