CVE-2026-33390

HighCVSS 8.1/10Last modified Aug 11, 2026

Description

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-266

Affected software

Vendor	Product	Versions
Nozomi Networks	Guardian	< 26.2.0
Nozomi Networks	CMC	< 26.2.0
Siemens	RUGGEDCOM APE1808	< *

References

https://security.nozominetworks.com/NN-2026:13-01Mitigation, Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-827968.html

Timeline

Published: Jul 9, 2026
Last modified: Aug 11, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-333915.4An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privi CVE-2026-333927.2In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass CVE-2026-333934.3Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `allowed_spam_host_domains CVE-2026-333942.7Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the Post Edits admin report (/CVE-2026-333955.4Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the discourse-graphviz plugin CVE-2026-333969.9OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMem CVE-2026-333976.1The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branc CVE-2026-333987.1NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/pages/forum/get_quotes.php` only checks whether the c CVE-2026-333997.7Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE CVE-2026-33406.5IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated a CVE-2026-334005.4Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerabi CVE-2026-334016.5Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the patch introduced in commit e8a513591 (CVE