Skip to navigation

Threat reportVulnerabilityTL-2026-2487

Multiple Vulnerabilities in Nozomi Guardian/CMC Before 25.4.0 on Siemens RUGGEDCOM APE1808 Devices (CVE-2024-13089, CVE-2024-13090, CVE-2025-3719, CVE-2025-40889, et al.)

highACTIVE

Siemens ProductCERT advisory SSA-978177 (CISA ICSA-25-226-09) discloses eleven CVEs affecting Nozomi Guardian/CMC prior to version 25.4.0 running on RUGGEDCOM APE1808 industrial edge computing appliances, spanning OS command injection, sudo-based privilege escalation, access-control bypass, SQL injection, path traversal, and stored/reflected cross-site scripting. First disclosed .

Key facts for RUGGEDCOM Nozomi Guardian flaws

IdentifiersTL-2026-2487, CVE-2024-13089, CVE-2024-13090, CVE-2025-1501, CVE-2025-3718, CVE-2025-3719, CVE-2025-40885, CVE-2025-40886, CVE-2025-40887, CVE-2025-40888, CVE-2025-40889, CVE-2025-40890
Also known asSSA-978177, ICSA-25-226-09
SeverityHIGH
CVSS8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
First disclosed
Exploitation statusNo exploitation observed (theoretical)
EPSSCVE-2024-13089: 1.0% (62.2th percentile); CVE-2025-40889: 0.4% (32.8th percentile); CVE-2025-3719: 0.2% (17.3th percentile)
Affected productsSiemens RUGGEDCOM APE1808; Nozomi Networks Guardian; Nozomi Networks CMC (Central Management Console)
Weaknesses (CWE)CWE-78, CWE-250, CWE-863, CWE-22, CWE-89, CWE-79
MITRE ATT&CK techniquesT1005 Data from Local System, T1059.004 Unix Shell, T1059.007 JavaScript, T1068 Exploitation for Privilege Escalation, T1078 Valid Accounts, T1078.003 Local Accounts, T1190 Exploit Public-Facing Application, T1204.001 User Execution: Malicious Link, T1204.002 Malicious File, T1213 Data from Information Repositories, T1485 Data Destruction, T1548.003 Sudo and Sudo Caching and 2 more in the attack flow
MotivationUNKNOWN
Target sectorscritical manufacturing
Target regionsWorldwide
Detection rules9 (1 shown free)
Sources14 cited sources

Detection coverage for RUGGEDCOM Nozomi Guardian flaws

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2487 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Nozomi Guardian/CMC Sudo Abuse & Unauthorized Administrative CLI Command — Post-Exploitation

Detects excessive sudo-rule invocation by the Guardian/CMC service account (CVE-2024-13090), a limited-privilege CLI user issuing administrative commands via the CLI incorrect-authorization flaw (CVE-2025-3719), and unauthorized network-trace-file download by a limited-privilege account (CVE-2025-1501). This is the post-exploitation stage where an attacker who has already reached a low-privilege account escalates to administrative control or exfiltrates operational data.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1548.003, T1078.003, T1005, T1213
  • Data sources: syslog, linux_auditd, guardian_cmc_cli_audit_log
  • Severity: high
  • Confidence: high

Splunk SPL

index=ot_security sourcetype IN ("linux:secure","guardian:cmc:cli")
| eval is_sudo=if(match(_raw, "sudo:.*COMMAND="), 1, 0)
| eval limited_user=if(user_role IN ("limited","operator"), 1, 0)
| where (is_sudo=1 AND match(_raw, "NOPASSWD") AND command!="/opt/nozomi/bin/*known_good*")
   OR (sourcetype="guardian:cmc:cli" AND limited_user=1 AND cli_command IN ("config set*","user add*","system reboot*","network*","firewall*"))
   OR (sourcetype="guardian:cmc:cli" AND limited_user=1 AND cli_command="*trace*download*")
| stats count values(cli_command) as commands values(command) as sudo_commands by user, src_ip
| where count >= 1

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where ProcessName == "sudo" or SyslogMessage has "sudo:"
| where SyslogMessage has_any ("NOPASSWD", "COMMAND=/opt/nozomi")
| extend Account = extract(@"sudo:\s*(\S+)", 1, SyslogMessage), EventKind = "sudo_abuse"
| union (
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DeviceProduct has_any ("Guardian","CMC")
    | where DeviceEventClassID == "cli_command"
    | where AdditionalExtensions has_any ("config set","user add","system reboot","trace","network","firewall")
    | where SourceUserPrivileges in ("limited","operator")
    | extend Account = SourceUserName, EventKind = "unauthorized_cli_admin"
)
| summarize EventCount = count(), Commands = make_set(SyslogMessage) by Account, EventKind, bin(TimeGenerated, 1h)
| where EventCount >= 1

Sigma

title: Nozomi Guardian/CMC Sudo Abuse or Unauthorized Administrative CLI Command by Limited-Privilege Account
id: e1a2b3c4-2222-4a2a-8a2a-222222222222
status: experimental
description: Detects excessive sudo-rule invocation by the Guardian/CMC service account (CVE-2024-13090), a limited-privilege CLI user issuing administrative commands via the incorrect-authorization flaw in the CLI (CVE-2025-3719), and unauthorized trace-file download by a limited-privilege account (CVE-2025-1501)
references:
  - https://security.nozominetworks.com/NN-2025:2-01/
  - https://security.nozominetworks.com/NN-2025:5-01/
  - https://security.nozominetworks.com/NN-2025:3-01/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-13
tags:
  - attack.privilege_escalation
  - attack.t1548.003
  - attack.t1078.003
  - attack.collection
  - attack.t1005
  - attack.t1213
  - cve.2024.13090
  - cve.2025.3719
  - cve.2025.1501
logsource:
  product: linux
  service: sudo
detection:
  selection_sudo:
    SyslogMessage|contains:
      - 'NOPASSWD'
      - 'COMMAND=/opt/nozomi'
  selection_cli_admin:
    UserPrivilege: 'limited'
    CliCommand|contains:
      - 'config set'
      - 'user add'
      - 'system reboot'
      - 'trace'
  condition: 1 of selection_*
falsepositives:
  - Scheduled maintenance jobs run by the service account under an approved change ticket
  - Break-glass administrative access explicitly authorized and logged in the change-management system
level: high

Known false positives:

  • Approved maintenance windows where the service account legitimately invokes sudo-permitted update commands
  • Authorized privileged operators temporarily granted the limited role during an incident who perform legitimate admin actions

Tuning notes: Cross-reference the acting account against the current change-management ticket queue before alerting; suppress the specific NOPASSWD command set Nozomi ships by default once confirmed benign and alert only on commands outside that shipped allowlist.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Nozomi Guardian/CMC Update-Signature Bypass & Web-Parameter Injection — Exploitation · unlock with TL Creds
  • Nozomi Guardian/CMC Sudo Abuse & Unauthorized Administrative CLI Command — Post-Exploitation · unlock with TL Creds
  • Nozomi Guardian/CMC Malicious Dashboard Share & Time Machine Path-Traversal Tampering — C2/Lateral Movement · unlock with TL Creds
  • Nozomi Guardian/CMC Update-Signature Bypass & Web-Parameter Injection — Exploitation · unlock with TL Creds
  • Nozomi Guardian/CMC Sudo Abuse & Unauthorized Administrative CLI Command — Post-Exploitation · unlock with TL Creds
  • Nozomi Guardian/CMC Malicious Dashboard Share & Time Machine Path-Traversal Tampering — C2/Lateral Movement · unlock with TL Creds
  • Nozomi Guardian/CMC Update-Signature Bypass & Web-Parameter Injection — Exploitation · unlock with TL Creds
  • Nozomi Guardian/CMC Malicious Dashboard Share & Time Machine Path-Traversal Tampering — C2/Lateral Movement · unlock with TL Creds

Indicators of compromise for RUGGEDCOM Nozomi Guardian flaws

As of 2026-11-07, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-2487.

12 indicators of compromise · unlock with TL Creds. Compare plans

How RUGGEDCOM Nozomi Guardian flaws works

All eleven have vendor-released fixes and none is known to be publicly exploited or to have a public PoC.

Nozomi Networks disclosed eleven vulnerabilities in its Guardian and Central Management Console (CMC) OT network-monitoring software between June 2025 and November 2025 via its PSIRT portal (security.nozominetworks.com). Because Siemens embeds Guardian/CMC as the OT-monitoring stack on its RUGGEDCOM APE1808 industrial edge-computing appliance, Siemens ProductCERT republished the set as SSA-978177 (first published 2025-08-12, updated to v1.3 on 2026-01-13 to add the final CVE), and CISA mirrored it as ICS advisory ICSA-25-226-09 (2025-08-14) for the Critical Manufacturing sector, worldwide.

The most severe issues are CVE-2024-13089 (CVSS 3.1 7.2 / CWE-78), where an authenticated administrator can bypass improper signature validation in the Guardian/CMC update mechanism to execute arbitrary OS commands via a crafted update package, and CVE-2024-13090 (CVSS 3.1 7.0 / CWE-250), where a local service account was configured with excessively permissive sudo rules, letting an attacker who compromises that account escalate to administrative control. Both were fixed in 24.6.0.

A second cluster, published 2025-10-07, covers CVE-2025-3719 (CVSS 3.1 8.1 / CWE-863) — an incorrect-authorization flaw in the CLI that lets a limited-privilege authenticated user issue administrative commands and alter device configuration — and CVE-2025-40889 (CVSS 3.1 8.1 / CWE-22), a path-traversal bug in the Time Machine feature caused by missing validation of two input parameters, letting a limited-privilege user alter the structure/content of files under /data or affect their availability. The same batch adds four authenticated SQL-injection flaws (CWE-89) in the Alert, Smart Polling, and CLI functionality (CVE-2025-40885, CVE-2025-40886 [CVSS 3.1 8.8, the highest raw score in the set], CVE-2025-40887, CVE-2025-40888) that let a limited-privilege user run arbitrary SELECT (and, for 40886, broader) SQL statements against the application's DBMS, and a client-side path-traversal/XSS flaw in the web front-end (CVE-2025-3718, CWE-22) triggerable by a crafted URL visited by an authenticated victim. CVE-2025-1501 (CVSS 3.1 4.3 / CWE-863, published 2025-08-26, fixed in CMC 25.1.0) is a lower-severity access-control gap letting a limited-privilege user request and download network trace files they should not have access to.

The final and most recently added issue, CVE-2025-40890 (CVSS 3.1 7.9 / CWE-79, published 2025-11-25, fixed in 25.4.0), is a stored XSS in the Dashboards feature: a low-privilege authenticated user can craft a dashboard containing a JavaScript payload and share it, executing in the browser session of any victim who views or imports it.

No individual CVE requires unauthenticated network access (all but the two 2024 CVEs require an existing low- or limited-privilege account), and CISA states no known public exploitation has been reported for any of them; no public proof-of-concept exists for the set. Because the flaws sit across privilege escalation (3719, 13090), data-store access (the SQLi cluster), and file/dashboard integrity (40889, 40890), an attacker who first obtains a low-privilege Guardian/CMC account — e.g. via credential reuse or a phished session — could plausibly chain them to reach administrative CLI control, exfiltrate alerting/asset data from the DBMS, and tamper with stored monitoring artifacts, which is significant given Guardian/CMC's role as the OT visibility and alerting layer on RUGGEDCOM APE1808 deployments. Siemens recommends upgrading to Guardian/CMC 25.4.0 via the CLI, noting the Web GUI upgrade path may error.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Execution

T1059.004 Unix Shell; T1059.007 JavaScript; T1204.001 User Execution: Malicious Link; T1204.002 Malicious File

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.003 Local Accounts; T1548.003 Sudo and Sudo Caching

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Impact

T1485 Data Destruction; T1565.001 Stored Data Manipulation

defense-impairment

T1553 Subvert Trust Controls

Remediation for RUGGEDCOM Nozomi Guardian flaws

Patches

  • Nozomi Guardian/CMC V25.4.0 (Siemens SSA-978177 recommended target version)
  • Guardian/CMC 24.6.0 fixes CVE-2024-13089 and CVE-2024-13090
  • Guardian/CMC 25.1.0 fixes CVE-2025-1501
  • Guardian/CMC 25.2.0 fixes CVE-2025-3718, CVE-2025-3719, CVE-2025-40885, CVE-2025-40886, CVE-2025-40887, CVE-2025-40889
  • Guardian/CMC 25.3.0 fixes CVE-2025-40888
  • Guardian/CMC 25.4.0 fixes CVE-2025-40890

Immediate actions

  • Upgrade Nozomi Guardian/CMC on all affected RUGGEDCOM APE1808 devices to V25.4.0, applying the update via the CLI (Siemens notes the Web GUI upgrade path may error)
  • Restrict access to the Guardian/CMC web management interface and CLI to trusted management networks using internal firewall rules / network segmentation
  • Audit and remove unnecessary user accounts that have access to the web or CLI interfaces, and review the sudoers configuration for local service accounts
  • Only install Guardian/CMC update packages obtained from trusted, verified sources

Workarounds

  • Restrict web management interface and CLI access via network-based access control until the upgrade is applied
  • Exercise caution with untrusted links and shared/imported dashboards while authenticated to Guardian/CMC

Longer-term hardening

  • Apply least-privilege to service-account sudoers entries and periodically audit sudo configuration on Guardian/CMC hosts
  • Use VPNs or equivalent for any necessary remote administrative access to RUGGEDCOM APE1808 devices
  • Monitor CLI and web-interface authentication/authorization logs for anomalous privilege-escalation, SQL-error, or path-traversal attempts
  • Follow Siemens' Operational Guidelines for Industrial Security and keep ICS/OT monitoring networks segmented from business IT and the Internet

Affected and fixed versions

  • Siemens — RUGGEDCOM APE1808
    Vulnerable versions: All versions running Nozomi Guardian/CMC before V25.4.0
    Fixed in: Nozomi Guardian/CMC V25.4.0 (apply via CLI; Web GUI upgrade path may error)
  • Nozomi Networks — Guardian
    Vulnerable versions: < 24.6.0; < 25.1.0; < 25.2.0; < 25.3.0; < 25.4.0
    Fixed in: 25.4.0
  • Nozomi Networks — CMC (Central Management Console)
    Vulnerable versions: < 24.6.0; < 25.1.0; < 25.2.0; < 25.3.0; < 25.4.0
    Fixed in: 25.4.0

Timeline of RUGGEDCOM Nozomi Guardian flaws

Last updated · revalidated 1× · latest source

  • locked-ioc-9 PSIRT publishes NN-2025:1-01 (CVE-2024-13089, OS command injection via improper update-signature validation) and NN-2025:2-01 (CVE-2024-13090, sudo privilege escalation); both fixed in Guardian/CMC 24.6.0.
  • locked-ioc-8 publishes SSA-978177 v1.0, republishing the Nozomi Guardian/CMC vulnerabilities for RUGGEDCOM APE1808 devices.
  • CISA republishes the advisory as ICS advisory ICSA-25-226-09 for the Critical Manufacturing sector, noting worldwide deployment and no known public exploitation.
  • locked-ioc-9 publishes NN-2025:3-01 (CVE-2025-1501, improper access control letting a limited-privilege user download network trace files); fixed in CMC 25.1.0.
  • locked-ioc-9 publishes seven CVEs in one batch: CVE-2025-3718 (client-side path traversal/XSS), CVE-2025-3719 (CLI authorization bypass, CVSS 8.1), CVE-2025-40885/40886/40887 (SQL injection in Smart Polling/Alert), CVE-2025-40888 (SQL injection in CLI), and CVE-2025-40889 (path traversal in Time Machine, CVSS 8.1); fixed across Guardian/CMC 25.2.0 (all but 40888) and 25.3.0 (40888).
  • Siemens updates SSA-978177 to V1.1, adding eight further CVEs (CVE-2025-1501, -40888, -3718, -3719, -40885, -40886, -40887, -40889).
  • Siemens updates SSA-978177 to V1.2, adding RUGGEDCOM APE1808 remediation guidance.
  • locked-ioc-9 publishes NN-2025:11-01 (CVE-2025-40890, stored XSS via a shared/imported malicious dashboard); fixed in Guardian/CMC 25.4.0, the version Siemens now recommends for RUGGEDCOM APE1808.
  • Siemens updates SSA-978177 to v1.3, adding CVE-2025-40890 to the RUGGEDCOM APE1808 advisory.
  • CISA republishes a related but distinct locked-ioc-7 advisory (ICSA-26-015-07) covering four additional Nozomi-inherited CVEs (CVE-2025-40891/40892/40893/40898), showing continued disclosure activity for this OT network-monitoring platform outside the scope of SSA-978177's eleven CVEs.

Update history

Sources cited for RUGGEDCOM Nozomi Guardian flaws

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 14 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats