EUVD-2026-72787
GHSA-8g88-35qx-36v7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MitM network positioning prerequisite raises AC:H; scope change applies as impact falls on polled devices (subsequent systems); credentials captured yield high confidentiality loss on those systems.
Primary rating from Vendor (nozominetworks).
CVSS VectorVendor: nozominetworks
Lifecycle Timeline
2DescriptionCVE.org
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
AnalysisAI
Credential interception via man-in-the-middle attack is possible against Nozomi Networks Guardian sensors using the Smart Polling feature, which establishes encrypted connections to polled OT/ICS devices without validating the remote host's identity and provides no configuration option to enable such validation. An attacker with network positioning between the sensor and a target device can impersonate the device, capture the authentication credentials transmitted during polling sessions, and replay those credentials to authenticate directly against the device or other devices sharing the same credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Smart Polling feature must be enabled and actively configured to poll target devices; if Smart Polling is disabled or not deployed, the vulnerable code path is not reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) reflects a meaningful MitM prerequisite (AT:P) that constrains exploitation: the attacker must achieve network positioning between the sensor and a polled device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the vendor-released patch referenced in Nozomi Networks advisory NN-2026:20-01 at https://security.nozominetworks.com/NN-2026:20-01; no specific fix version number was included in the available data, so the advisory must be consulted for the exact patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today