Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)

Key facts for Nozomi Guardian CMC flaws

Detection coverage for Nozomi Guardian CMC flaws

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5489 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Nozomi Guardian/CMC Stored XSS / Template Injection in Report, Asset and User Fields (CVE-2025-40892, CVE-2025-40899, CVE-2025-40900)

Detects HTML/JavaScript and Angular template-injection payloads submitted to Nozomi Guardian/CMC (RUGGEDCOM APE1808, SSA-827968) report, custom-field, user, credential, snapshot and schedule endpoints. These are the stored XSS / HTML injection flaws (CVE-2025-40892, CVE-2025-40899, CVE-2025-40900, CVE-2025-40891, CVE-2025-40901 to 40904) that execute in the browser of any user viewing or importing the object. Requires HTTP request-body visibility (Splunk Stream, WAF or reverse-proxy form logging) in front of the management interface.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.007, T1565.001, T1204.001
• Data sources: splunk_stream_http, waf_or_reverse_proxy_logs, nozomi_guardian_web_access
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype="stream:http" http_method IN ("POST","PUT","PATCH") (site="*guardian*" OR site="*nozomi*" OR site="*cmc*")
(uri_path="*report*" OR uri_path="*custom_field*" OR uri_path="*nodes*" OR uri_path="*credential*" OR uri_path="*users*" OR uri_path="*smart_polling*" OR uri_path="*snapshot*" OR uri_path="*schedule*")
| eval payload=urldecode(coalesce(form_data, "") . " " . coalesce(uri_query, ""))
| where match(payload, "(?i)([<](script|iframe|svg|img)|onerror\s*=|onload\s*=|javascript:|\{\{[^}]*(constructor|\$eval|\$on))")
| eval cve_hint=case(match(uri_path,"(?i)report"),"CVE-2025-40892/CVE-2025-40900", match(uri_path,"(?i)custom_field|nodes"),"CVE-2025-40899", match(uri_path,"(?i)credential"),"CVE-2025-40901", match(uri_path,"(?i)users"),"CVE-2025-40902", true(),"CVE-2025-40891/40903/40904")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uris values(cve_hint) as cve_hint by src_ip site
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod in~ ("POST", "PUT", "PATCH")
| where DestinationHostName has_any ("guardian", "nozomi", "cmc") or DeviceProduct has "Nozomi"
| where RequestURL has_any ("report", "custom_field", "nodes", "credential", "users", "smart_polling", "snapshot", "schedule")
| extend Payload = url_decode(strcat(RequestURL, " ", AdditionalExtensions))
| where Payload matches regex @'(?i)([<](script|iframe|svg|img)|onerror\s*=|onload\s*=|javascript:|\{\{[^}]*(constructor|\$eval|\$on))'
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, SourceUserName, RequestMethod, RequestURL, Payload

Sigma

title: Nozomi Guardian/CMC Stored XSS or Template Injection Payload in Management Requests
id: 3b8f6a52-1c0e-4d7a-9b41-5e2a7c9d1f01
status: experimental
description: Detects script, HTML event-handler or Angular template-injection payloads submitted to Nozomi Guardian/CMC report, asset custom-field, user, credential and snapshot endpoints (CVE-2025-40892, CVE-2025-40899, CVE-2025-40900, CVE-2025-40891, CVE-2025-40901 to CVE-2025-40904).
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-827968.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059.007
    - attack.impact
    - attack.t1565.001
    - attack.t1204.001
    - cve.2025.40892
    - cve.2025.40899
    - cve.2025.40900
logsource:
    category: webserver
detection:
    selection_method:
        cs-method:
            - 'POST'
            - 'PUT'
            - 'PATCH'
    selection_uri:
        c-uri|contains:
            - 'report'
            - 'custom_field'
            - 'nodes'
            - 'credential'
            - 'users'
            - 'smart_polling'
            - 'snapshot'
            - 'schedule'
    selection_payload:
        cs-uri-query|contains:
            - '<script'
            - '%3Cscript'
            - '<iframe'
            - '<svg'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - '{{constructor'
            - '$eval'
    condition: selection_method and selection_uri and selection_payload
falsepositives:
    - Administrators pasting HTML snippets into report descriptions
    - Vulnerability scanners probing the management interface
level: high

Known false positives:

• Administrators pasting HTML snippets into report descriptions or asset custom fields
• Authorised vulnerability scanners or pentests against the management interface

Tuning notes: Replace the site= host filters with the real Guardian/CMC FQDNs; exclude scanner source IPs; if request bodies are not logged the rule only sees URL-borne payloads, so enable body capture on the reverse proxy/WAF. Alert at critical when the source user holds report privileges but is not on the report-author roster.

• 🔒 Nozomi Guardian/CMC Arc Data Archive Import Path Traversal (CVE-2025-40898) · unlock with TL Creds
• 🔒 Nozomi Guardian/CMC SSH Key Sync Endpoint Enumeration (CVE-2026-31983) · unlock with TL Creds
• 🔒 Nozomi Guardian/CMC Admin CLI Commands Pushed Through Arc Sensor Sync (CVE-2026-33390) · unlock with TL Creds
• 🔒 HTML/Script Markup in Crafted Network Traffic Targeting Nozomi Asset List (CVE-2025-40893) · unlock with TL Creds
• 🔒 Nozomi Guardian/CMC Management Interface Accessed from Untrusted Network (SSA-827968) · unlock with TL Creds
• 🔒 Nozomi Guardian/CMC SAML SSO External Redirect Poisoning (CVE-2026-31982) · unlock with TL Creds
• 🔒 Nozomi Guardian/CMC View-Only Threat Intelligence User Performing Administrative Actions (CVE-2025-40897) · unlock with TL Creds
• 🔒 Nozomi Guardian/CMC Oversized Request Flood — Audit Log Disk Exhaustion DoS (CVE-2026-31984) · unlock with TL Creds

Indicators of compromise for Nozomi Guardian CMC flaws

As of 2026-11-07, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-5489.

How Nozomi Guardian CMC flaws works

Siemens ProductCERT published SSA-827968 on 2026-01-13 (last updated 2026-08-11, version 1.4) relaying vulnerabilities disclosed by Nozomi Networks in its Guardian (network/OT monitoring sensor) and Central Management Console (CMC) software, which ships on the Siemens RUGGEDCOM APE1808 application-hosting platform. All versions of RUGGEDCOM APE1808 running Nozomi Guardian/CMC earlier than V26.2.0 are affected. The advisory lists 17 CVEs: CVE-2025-40891 to CVE-2025-40894, CVE-2025-40897 to CVE-2025-40904, CVE-2026-31981 to CVE-2026-31984 and CVE-2026-33390.

The largest group is injection in the web management interface. CVE-2025-40892 (Reports) and CVE-2025-40899 (Assets/Nodes custom fields) are stored XSS rated CVSS v3.1 8.9. Authenticated users with report privileges can plant JavaScript that runs in the browser of any user who views or imports the report; CVE-2025-40892 is scored CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H. CVE-2025-40900 is Angular template injection in Reports (CWE-1336). Stored HTML injection (CWE-79) affects Time Machine Snapshot Diff (CVE-2025-40891), the Asset List via crafted network packets (CVE-2025-40893, unauthenticated vector), the Alerted Nodes dashboard (CVE-2025-40894), Credentials Manager (CVE-2025-40901), Users (CVE-2025-40902), Schedule Restore Archive (CVE-2025-40903), Smart Polling (CVE-2025-40904) and the Diagram/Graph view (CVE-2026-31981).

The remaining flaws are access-control and availability issues. CVE-2025-40897 (CWE-863) lets view-only Threat Intelligence users perform administrative actions. CVE-2025-40898 (CWE-22) is path traversal in Arc data archive import that allows arbitrary file writes by low-privilege users. CVE-2026-31982 (CWE-601) is an open redirect in SAML SSO where an unauthenticated attacker poisons a cached SAML redirection. CVE-2026-31983 (CWE-306) is missing authentication on the SSH key sync endpoint, exposing user lists and public keys. CVE-2026-31984 (CWE-770, CVSS v4.0 8.7, v3.1 7.5) lets an unauthenticated user exhaust disk space with oversized audit log entries. CVE-2026-33390 (CWE-266, v3.1 8.1) lets Arc sensors receive CLI permissions so a limited-privilege user can push administrative CLI commands through sync. Nozomi credits its own Product Security team (Andrea Palanca) for finding CVE-2026-31984 and CVE-2026-33390 in internal testing.

Sources reviewed do not report active exploitation or public PoC code. Remediation is to upgrade Guardian/CMC to V26.2.0 (contact Nozomi/Siemens support for the patch). Interim mitigations from Nozomi advisories include restricting access to the web management interface with internal firewall rules, auditing user accounts and report templates, and disabling or removing untrusted Arc sensors.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1059.007 JavaScript; T1204.001 Malicious Link

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1087 Account Discovery

Impact

T1499.003 Application Exhaustion Flood; T1565.001 Stored Data Manipulation

Remediation for Nozomi Guardian CMC flaws

Patches

• Upgrade Nozomi Guardian/CMC to V26.2.0 or later; contact customer support to receive patch and update information

Immediate actions

• Restrict access to the Guardian/CMC web management interface with internal firewall rules
• Audit and remove unnecessary user accounts and review existing report templates
• Review enabled Arc sensors and disable or remove any untrusted ones

Workarounds

• Limit network reachability of the web interface to trusted management networks

Longer-term hardening

• Apply Siemens industrial security operational guidelines and network access controls
• Monitor Nozomi Networks PSIRT and Siemens ProductCERT advisories for Guardian/CMC updates

Affected and fixed versions

• Siemens — RUGGEDCOM APE1808 (with Nozomi Guardian/CMC)
  Vulnerable versions: All versions with Nozomi Guardian/CMC < V26.2.0
  Fixed in: Nozomi Guardian/CMC V26.2.0
• Nozomi Networks — Guardian
  Vulnerable versions: < 26.2.0
  Fixed in: 26.2.0
• Nozomi Networks — Central Management Console (CMC)
  Vulnerable versions: < 26.2.0
  Fixed in: 26.2.0

Timeline of Nozomi Guardian CMC flaws

• 2025-12-18 CVE-2025-40892 (stored XSS in Reports, Guardian/CMC < 25.5.0) published via Nozomi advisory NN-2025:13-01
• 2026-01-13 locked-ioc-4 publishes SSA-827968 for RUGGEDCOM APE1808 running Nozomi Guardian/CMC
• 2026-03-19 CVE-2026-33390 (incorrect privilege assignment in Arc sensor sync) reserved
• 2026-07-07 Nozomi publishes NN-2026:11-01 (CVE-2026-31984 audit-log DoS) and NN-2026:13-01 (CVE-2026-33390), both fixed in 26.2.0
• 2026-07-09 CVE-2026-33390 record published
• 2026-08-11 Siemens SSA-827968 updated to version 1.4 listing 17 CVEs; CVE records for the set updated

Sources cited for Nozomi Guardian CMC flaws

• Siemens SSA-827968: Vulnerability in Nozomi Guardian/CMC Before V26.2.0 on RUGGEDCOM APE1808 Devices cert-portal.siemens.com · Advisory · 2026-01-13
• INCIBE-CERT early warning CVE-2026-31984 incibe.es · Advisory
• Nozomi Networks Product Security Incident Response Team Portal security.nozominetworks.com · Vendor report
• NN-2026:11-01 DoS through oversized audit log entries in Guardian/CMC before 26.2.0 (CVE-2026-31984) security.nozominetworks.com · Vendor report · 2026-07-07
• NN-2026:13-01 Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0 (CVE-2026-33390) security.nozominetworks.com · Vendor report · 2026-07-07
• NN-2025:13-01 Stored XSS in Reports (CVE-2025-40892) security.nozominetworks.com · Vendor report · 2025-12-18
• GCVE record for CVE-2025-40892 db.gcve.eu · Research · 2025-12-18
• CVE-2026-33390 analysis (Lutra Security Field Guide) fieldguide.lutrasecurity.com · Research · 2026-07-09
• OpenCVE CVE-2026-31984 app.opencve.io · Research

More in vulnerability

• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)
• Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)
• SSA-365200: Google Chrome V8 Type Confusion Vulnerability (CVE-2025-6554) in Siemens HyperLynx and Industrial Edge App Publisher