Nozomi Networks Guardian CVE-2026-33389

The Smart Polling feature must be enabled and actively configured to poll target devices; if Smart Polling is disabled or not deployed, the vulnerable code path is not reachable. The attacker must achieve a man-in-the-middle network position on the path between the Nozomi Guardian sensor and at least one polled device - for example via ARP poisoning, rogue DHCP, or physical/logical switch insertion on a shared Layer 2 segment. A polling session must be in progress or must occur during the attacker's positioning window. Exploitation is limited to network segments accessible to the attacker; remote internet-based exploitation is not possible unless the sensor's polling traffic traverses an untrusted WAN path. The credential replay impact is amplified when polled devices share common credentials, which is a common condition in OT/ICS fleet deployments but not universal.

The CVSS 4.0 score of 5.3 (Medium) reflects a meaningful MitM prerequisite (AT:P) that constrains exploitation: the attacker must achieve network positioning between the sensor and a polled device. In OT/ICS environments this constraint is less limiting than in typical enterprise IT, since industrial networks often have flat or poorly segmented Layer 2 topologies, legacy switches lacking 802.1X, and devices accessible via shared VLANs - conditions that make ARP spoofing or rogue switch insertion tractable. The credential replay vector is particularly dangerous in OT contexts where default or shared credentials across device fleets are common operational practice. No EPSS data is available for comparison. No public exploit code or active exploitation in CISA KEV has been identified. The effective real-world risk to organizations operating Nozomi Guardian in flat OT network segments is higher than the base score suggests, because the MitM prerequisite is easier to satisfy in those environments and credential reuse amplifies blast radius.

An attacker with access to a network segment shared by a Nozomi Guardian sensor and its polled OT devices performs ARP spoofing or inserts a rogue managed switch to achieve MitM positioning on the polling path. When the sensor initiates a Smart Polling session to a PLC or SCADA endpoint, the attacker presents a forged endpoint identity that the sensor accepts without certificate or host key validation, captures the authentication credentials in plaintext or decrypted form, and then authenticates directly to the target device - or to other devices on the same network that share those credentials - to read, modify, or disrupt operational data. No public proof-of-concept code has been identified, but the attack technique (MitM + credential replay) is well-understood and requires no novel tooling.