Security Resilience

CVE-2026-33389

Published
08 September 2026
Modified
15 October 2026
CVSS Score v4 5.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0017 6th percentile
Risk Priority 35 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-33389 is a medium-severity Lack of Administrator Control over Security (CWE-671) vulnerability in Nozominetworks (inferred from references). Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and CM-7 (Least Functionality) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a…

more

sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.

CWE(s)
CWE-671

Related Threats

CVEs Like This One

CVE-2026-31985Shared CWE-671
CVE-2025-24024Shared CWE-671
CVE-2023-20115Shared CWE-671

Affected Assets

Nozominetworks
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

CM-6 Configuration Settings good match

Mandating documented configuration settings that reflect restrictive modes directly requires the product to expose tunable security parameters to administrators.

CM-7 Least Functionality good match

Requiring configuration of least functionality forces the product to let administrators restrict or enable features rather than hard-coding them.

AC-6 Least Privilege partial match

Least-privilege assignment presupposes that administrators can grant or withhold specific privileges instead of having them fixed by the product.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-671, a class-level weakness, and none of its children carries one either.

References