# Multiple Vulnerabilities in Nozomi Guardian/CMC Before 25.4.0 on Siemens RUGGEDCOM APE1808 Devices (CVE-2024-13089, CVE-2024-13090, CVE-2025-3719, CVE-2025-40889, et al.)

> Siemens ProductCERT advisory SSA-978177 (CISA ICSA-25-226-09) discloses eleven CVEs affecting Nozomi Guardian/CMC prior to version 25.4.0 running on RUGGEDCOM APE1808 industrial edge computing appliances, spanning OS command injection, sudo-based privilege escalation, access-control bypass, SQL injection, path traversal, and stored/reflected cross-site scripting. All eleven have vendor-released fixes and none is known to be publicly exploited or to have a public PoC.

- **Published:** 2026-09-13T00:00:00Z
- **Last reviewed:** 2026-09-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2487
- **ID:** TL-2026-2487
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-13089, CVE-2024-13090, CVE-2025-1501, CVE-2025-3718, CVE-2025-3719, CVE-2025-40885, CVE-2025-40886, CVE-2025-40887, CVE-2025-40888, CVE-2025-40889, CVE-2025-40890

## Description

Nozomi Networks disclosed eleven vulnerabilities in its Guardian and Central Management Console (CMC) OT network-monitoring software between June 2025 and November 2025 via its PSIRT portal (security.nozominetworks.com). Because Siemens embeds Guardian/CMC as the OT-monitoring stack on its RUGGEDCOM APE1808 industrial edge-computing appliance, Siemens ProductCERT republished the set as SSA-978177 (first published 2025-08-12, updated to v1.3 on 2026-01-13 to add the final CVE), and CISA mirrored it as ICS advisory ICSA-25-226-09 (2025-08-14) for the Critical Manufacturing sector, worldwide.

The most severe issues are CVE-2024-13089 (CVSS 3.1 7.2 / CWE-78), where an authenticated administrator can bypass improper signature validation in the Guardian/CMC update mechanism to execute arbitrary OS commands via a crafted update package, and CVE-2024-13090 (CVSS 3.1 7.0 / CWE-250), where a local service account was configured with excessively permissive sudo rules, letting an attacker who compromises that account escalate to administrative control. Both were fixed in 24.6.0.

A second cluster, published 2025-10-07, covers CVE-2025-3719 (CVSS 3.1 8.1 / CWE-863) — an incorrect-authorization flaw in the CLI that lets a limited-privilege authenticated user issue administrative commands and alter device configuration — and CVE-2025-40889 (CVSS 3.1 8.1 / CWE-22), a path-traversal bug in the Time Machine feature caused by missing validation of two input parameters, letting a limited-privilege user alter the structure/content of files under /data or affect their availability. The same batch adds four authenticated SQL-injection flaws (CWE-89) in the Alert, Smart Polling, and CLI functionality (CVE-2025-40885, CVE-2025-40886 [CVSS 3.1 8.8, the highest raw score in the set], CVE-2025-40887, CVE-2025-40888) that let a limited-privilege user run arbitrary SELECT (and, for 40886, broader) SQL statements against the application's DBMS, and a client-side path-traversal/XSS flaw in the web front-end (CVE-2025-3718, CWE-22) triggerable by a crafted URL visited by an authenticated victim. CVE-2025-1501 (CVSS 3.1 4.3 / CWE-863, published 2025-08-26, fixed in CMC 25.1.0) is a lower-severity access-control gap letting a limited-privilege user request and download network trace files they should not have access to.

The final and most recently added issue, CVE-2025-40890 (CVSS 3.1 7.9 / CWE-79, published 2025-11-25, fixed in 25.4.0), is a stored XSS in the Dashboards feature: a low-privilege authenticated user can craft a dashboard containing a JavaScript payload and share it, executing in the browser session of any victim who views or imports it.

No individual CVE requires unauthenticated network access (all but the two 2024 CVEs require an existing low- or limited-privilege account), and CISA states no known public exploitation has been reported for any of them; no public proof-of-concept exists for the set. Because the flaws sit across privilege escalation (3719, 13090), data-store access (the SQLi cluster), and file/dashboard integrity (40889, 40890), an attacker who first obtains a low-privilege Guardian/CMC account — e.g. via credential reuse or a phished session — could plausibly chain them to reach administrative CLI control, exfiltrate alerting/asset data from the DBMS, and tamper with stored monitoring artifacts, which is significant given Guardian/CMC's role as the OT visibility and alerting layer on RUGGEDCOM APE1808 deployments. Siemens recommends upgrading to Guardian/CMC 25.4.0 via the CLI, noting the Web GUI upgrade path may error.

## MITRE ATT&CK

- T1553 Subvert Trust Controls
- T1059.004 Unix Shell
- T1548.003 Sudo and Sudo Caching
- T1078.003 Local Accounts
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1190 Exploit Public-Facing Application
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1565.001 Stored Data Manipulation

## Sources

- [SSA-978177: Vulnerability in Nozomi Guardian/CMC Before 25.4.0 on RUGGEDCOM APE1808 Devices](https://cert-portal.siemens.com/productcert/html/ssa-978177.html)
- [ICSA-25-226-09: Siemens RUGGEDCOM APE1808](https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-09)
- [NN-2025:1-01 - OS command injection in update functionality in Guardian/CMC before 24.6.0 - CVE-2024-13089](https://security.nozominetworks.com/NN-2025:1-01/)
- [NN-2025:2-01 - Excessively permissive sudo rules in Guardian/CMC before 24.6.0 - CVE-2024-13090](https://security.nozominetworks.com/NN-2025:2-01/)
- [NN-2025:3-01 - Improper access control on trace file download in CMC before 25.1.0 - CVE-2025-1501](https://security.nozominetworks.com/NN-2025:3-01/)
- [NN-2025:4-01 - Client-side path traversal in Guardian/CMC before 25.2.0 - CVE-2025-3718](https://security.nozominetworks.com/NN-2025:4-01/)
- [NN-2025:5-01 - Incorrect authorization for CLI in Guardian/CMC before 25.2.0 - CVE-2025-3719](https://security.nozominetworks.com/NN-2025:5-01/)
- [NN-2025:6-01 - Authenticated SQL injection in Smart Polling functionality in Guardian/CMC before 25.2.0 - CVE-2025-40885](https://security.nozominetworks.com/NN-2025:6-01/)
- [NN-2025:7-01 - Authenticated SQL injection on Alert functionality in Guardian/CMC before 25.2.0 - CVE-2025-40886](https://security.nozominetworks.com/NN-2025:7-01/)
- [NN-2025:8-01 - Authenticated SQL injection on Alert functionality in Guardian/CMC before 25.2.0 - CVE-2025-40887](https://security.nozominetworks.com/NN-2025:8-01/)
- [NN-2025:9-01 - Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0 - CVE-2025-40889](https://security.nozominetworks.com/NN-2025:9-01/)
- [NN-2025:10-01 - Authenticated SQL injection in CLI functionality in Guardian/CMC before 25.3.0 - CVE-2025-40888](https://security.nozominetworks.com/NN-2025:10-01/)
- [NN-2025:11-01 - Stored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0 - CVE-2025-40890](https://security.nozominetworks.com/NN-2025:11-01/)
- [ICSA-26-015-07: Siemens RUGGEDCOM APE1808 Devices (related, distinct follow-on disclosure of CVE-2025-40891/40892/40893/40898)](https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-07)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2487