Siemens RUGGEDCOM APE1808 Nozomi Flaws Disclosed
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Siemens discloses five vulnerabilities in RUGGEDCOM APE1808 devices running Nozomi Guardian/CMC, including template injection and CSRF; no active exploitation reported.
Siemens ProductCERT, via CISA republication, disclosed five vulnerabilities (CVE-2026-33387, -33388, -33389, -33391, -33920) affecting all versions of RUGGEDCOM APE1808 devices that run Nozomi Guardian/CMC software. The flaws originate from Nozomi Networks' underlying product and include template injection in the Dashboards feature, insufficient access control in the Credentials Manager and Smart Polling configuration, improper certificate/host validation in Smart Polling (enabling man-in-the-middle credential interception), and a CSRF flaw in the login functionality (standard and SAML) that lacks anti-CSRF token validation. Highest CVSS v3 score is 7.5.
Exploitation of these flaws could allow authenticated or socially-engineered actions leading to browser-context code execution, credential disclosure or indirect compromise, disruption of device authentication and asset visibility, data tampering via MITM credential replay, and attribution manipulation of audit logs via CSRF. No public exploitation in the wild is reported; this is a coordinated vendor disclosure with Siemens directing customers to contact support for patches rather than publishing fixes directly in the advisory.
Affected organizations span critical manufacturing, transportation, energy, healthcare, financial services, and government sectors worldwide. CISA and Siemens recommend standard ICS hardening: minimizing network exposure, isolating control system networks behind firewalls, and using VPNs (kept updated) for remote access, alongside contacting Siemens customer support for patch and update information.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,989 reports from 143 sources, 543 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs