Nozomi Networks Guardian CVE-2026-33388

Exploitation requires a valid, authenticated account on the Nozomi Guardian or CMC platform with at least limited privileges - unauthenticated access is not possible. The Credentials Manager must be actively in use with one or more configured credential entries; environments that have not configured any credentials in the Credentials Manager are not exposed to meaningful impact. The exploitable entry subset is limited to entries the low-privilege user's role can see, reducing impact surface in well-segmented role configurations. Indirect credential capture requires the attacker to control infrastructure capable of accepting the authentication protocol (SSH, SNMP, etc.) that Guardian will use against the redirected target, and the capture window is bounded by the sensor's scheduled reconnection interval. Limiting factors: prior authenticated access required; no direct credential value disclosure; indirect extraction adds attacker-infrastructure dependency and time delay; impact is bounded by which credential entries are visible to the limited-privilege role.

The CVSS 4.0 base score of 6.4 reflects the authentication prerequisite (PR:L), placing this below the critical tier; however, the SC:H subsequent-system confidentiality metric captures the meaningful downstream risk - compromised or deleted credentials affect OT/ICS devices that depend on Guardian for authenticated monitoring, potentially blinding the sensor to an entire device class. Even a mid-sized municipal IT team in malbork managing an industrial control network would recognize that loss of authenticated visibility into OT endpoints is operationally significant and not merely a data-integrity nuisance. No CISA KEV listing is present and no public exploit code is identified, indicating this is not under active mass exploitation, but the insider or compromised-account threat profile is relevant given that limited-privilege accounts are a normal operational posture in multi-user Guardian/CMC deployments. The indirect credential-extraction vector - redirecting a credential entry's target host to attacker-controlled infrastructure and capturing the credential when the sensor reconnects - is plausible but adds operational complexity beyond simple delete/disrupt abuse. The CVSS 3.1 equivalent CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L yields approximately 6.4, consistent with the vendor score, and aligns well with the actual impact profile.

An attacker with a valid low-privilege Guardian or CMC account - whether an insider, a shared read-only monitoring account, or a credential obtained via phishing - navigates to the Credentials Manager and identifies a subset of entries visible to their role. The attacker edits the target hostname of an existing entry to point to an attacker-controlled SSH or authentication server, then waits for Guardian to use that credential at the next scheduled connection attempt, capturing the credential value as the sensor authenticates. Alternatively, the attacker simply deletes critical credential entries, causing Guardian to lose authenticated access to dependent OT devices and degrading monitoring coverage without leaving obvious signs of tampering in device logs.