Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0
Summary
| CVE | CVE-2026-33390 |
|---|---|
| State | PUBLISHED |
| Assigner | Nozomi |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-09 08:16:48 UTC |
| Updated | 2026-08-11 13:18:23 UTC |
| Description | An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability. |
Risk And Classification
Primary CVSS: v4.0 7.2 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002100000 probability, percentile 0.113820000 (date 2026-08-11)
Problem Types: CWE-266 | CWE-266 CWE-266 Incorrect privilege assignment
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7.2 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7.2 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 8.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
| 3.1 | CNA | CVSS | 8.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Nozominetworks | Cmc | All | All | All | All |
| Application | Nozominetworks | Guardian | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Nozomi Networks | Guardian | affected 26.2.0 semver | Not specified |
| CNA | Nozomi Networks | CMC | affected 26.2.0 semver | Not specified |
| ADP | Siemens | RUGGEDCOM APE1808 | affected * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.nozominetworks.com/NN-2026:13-01 | [email protected] | security.nozominetworks.com | Mitigation, Vendor Advisory |
| cert-portal.siemens.com/productcert/html/ssa-827968.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was found by Andrea Palanca of Nozomi Networks Product Security team during an internal investigation. (en)
Additional Advisory Data
Solutions
CNA: Upgrade to v26.2.0 or later.
Workarounds
CNA: Review all enabled sensors and disallow or delete untrusted ones.