These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-33390 is an Incorrect Privilege Assignment vulnerability in Nozomi Networks CMC and Guardian products. An authenticated user with limited privileges can push administrative CLI commands through sync, altering device configuration and/or affecting availability. The vulnerability allows for potential configuration changes and availability impacts. Organizations should prioritize patching.
CVE-2026-31984 is a denial-of-service vulnerability caused by unbounded resource allocation in the audit logging functionality of Nozomi Networks products. The vulnerability is due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space [truncated]
A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint of Nozomi Networks' CMC and Guardian products. An unauthenticated attacker can send a request to this endpoint and obtain the list of users who have uploaded their public SSH keys, their groups, and the uploaded public SSH keys. This vulnerability allows attackers to access sensitive information about users and [truncated]
CVE-2026-31982 is an Open Redirect vulnerability in Nozomi Networks' SAML Single Sign-On functionality. Insufficient validation of a user-controlled redirection parameter allows an unauthenticated attacker to craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On. This vulnerability can enable phishing and credentia [truncated]
CVE-2026-31981 is a Stored HTML Injection vulnerability in Nozomi Networks N2OS, allowing an authenticated user with administrative privileges to inject malicious HTML tags into configuration data. When viewed by a victim in the Diagram tab and Graph view, the injected HTML renders, enabling phishing and possibly open redirect attacks. The vulnerability exists due to insufficiently restrictive input valid [truncated]
CVE-2025-40904 is a medium-severity stored HTML injection issue in Nozomi Networks Smart Polling. According to the supplied description and NVD record, an authenticated user with limited privileges can submit malicious remote strategies containing HTML tags through sync. When another user views the affected strategy, the injected HTML renders in the browser, creating phishing and possible open-redirect ri [truncated]
CVE-2025-40902 is a stored HTML injection issue in Nozomi Networks Users functionality. An authenticated administrator can create a malicious user whose username contains HTML tags, and the injected content can render when another user attempts to delete a group containing that account. The practical impact described in the source material is browser-based phishing and possible open redirect abuse; the ve [truncated]
CVE-2025-40901 is a stored HTML injection issue in Nozomi Networks Credentials Manager. According to the CVE record, an authenticated user with administrative privileges can define a malicious identity containing HTML tags, and when another user attempts to delete that identity, the injected HTML is rendered in the browser. The stated impact is primarily phishing risk and possible open redirect behavior; [truncated]
CVE-2025-40900 is a medium-severity Angular template injection vulnerability affecting Nozomi Networks CMC and Guardian versions before 26.1.0. The issue is in the Reports functionality and stems from improper validation of an input parameter. An authenticated user with report privileges can create a malicious report, or a victim can be tricked into importing a malicious report template. When the report i [truncated]
An access control vulnerability in the Reports section of Siemens RUGGEDCOM APE1808LNX devices allows authenticated users with reporting privileges to bypass intended restrictions and modify reporting configuration. The flaw stems from improper enforcement of access controls for limited-privilege users. Successful exploitation requires the attacker to craft a specific application request, which could lead [truncated]