# Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)

> Siemens advisory SSA-827968 covers 17 vulnerabilities in Nozomi Networks Guardian/CMC before V26.2.0 on RUGGEDCOM APE1808 devices, including stored XSS, stored HTML injection, path traversal, access control bypass, missing authentication, open redirect, denial of service and incorrect privilege assignment. Siemens and Nozomi recommend upgrading to V26.2.0; no active exploitation or public PoC is reported in the sources.

- **Published:** 2026-11-07T06:31:56Z
- **Last reviewed:** 2026-11-07T06:31:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5489
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5489.png
- **ID:** TL-2026-5489
- **Severity:** HIGH (CVSS 8.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2025-40891, CVE-2025-40892, CVE-2025-40893, CVE-2025-40894, CVE-2025-40897, CVE-2025-40898, CVE-2025-40899, CVE-2025-40900, CVE-2025-40901, CVE-2025-40902, CVE-2025-40903, CVE-2025-40904, CVE-2026-31981, CVE-2026-31982, CVE-2026-31983, CVE-2026-31984, CVE-2026-33390

## Description

Siemens ProductCERT published SSA-827968 on 2026-01-13 (last updated 2026-08-11, version 1.4) relaying vulnerabilities disclosed by Nozomi Networks in its Guardian (network/OT monitoring sensor) and Central Management Console (CMC) software, which ships on the Siemens RUGGEDCOM APE1808 application-hosting platform. All versions of RUGGEDCOM APE1808 running Nozomi Guardian/CMC earlier than V26.2.0 are affected. The advisory lists 17 CVEs: CVE-2025-40891 to CVE-2025-40894, CVE-2025-40897 to CVE-2025-40904, CVE-2026-31981 to CVE-2026-31984 and CVE-2026-33390.

The largest group is injection in the web management interface. CVE-2025-40892 (Reports) and CVE-2025-40899 (Assets/Nodes custom fields) are stored XSS rated CVSS v3.1 8.9. Authenticated users with report privileges can plant JavaScript that runs in the browser of any user who views or imports the report; CVE-2025-40892 is scored CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H. CVE-2025-40900 is Angular template injection in Reports (CWE-1336). Stored HTML injection (CWE-79) affects Time Machine Snapshot Diff (CVE-2025-40891), the Asset List via crafted network packets (CVE-2025-40893, unauthenticated vector), the Alerted Nodes dashboard (CVE-2025-40894), Credentials Manager (CVE-2025-40901), Users (CVE-2025-40902), Schedule Restore Archive (CVE-2025-40903), Smart Polling (CVE-2025-40904) and the Diagram/Graph view (CVE-2026-31981).

The remaining flaws are access-control and availability issues. CVE-2025-40897 (CWE-863) lets view-only Threat Intelligence users perform administrative actions. CVE-2025-40898 (CWE-22) is path traversal in Arc data archive import that allows arbitrary file writes by low-privilege users. CVE-2026-31982 (CWE-601) is an open redirect in SAML SSO where an unauthenticated attacker poisons a cached SAML redirection. CVE-2026-31983 (CWE-306) is missing authentication on the SSH key sync endpoint, exposing user lists and public keys. CVE-2026-31984 (CWE-770, CVSS v4.0 8.7, v3.1 7.5) lets an unauthenticated user exhaust disk space with oversized audit log entries. CVE-2026-33390 (CWE-266, v3.1 8.1) lets Arc sensors receive CLI permissions so a limited-privilege user can push administrative CLI commands through sync. Nozomi credits its own Product Security team (Andrea Palanca) for finding CVE-2026-31984 and CVE-2026-33390 in internal testing.

Sources reviewed do not report active exploitation or public PoC code. Remediation is to upgrade Guardian/CMC to V26.2.0 (contact Nozomi/Siemens support for the patch). Interim mitigations from Nozomi advisories include restricting access to the web management interface with internal firewall rules, auditing user accounts and report templates, and disabling or removing untrusted Arc sensors.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1204.001 Malicious Link
- T1059 Command and Scripting Interpreter
- T1087 Account Discovery
- T1499.003 Application Exhaustion Flood
- T1565.001 Stored Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Nozomi Guardian/CMC Stored XSS / Template Injection in Report, Asset and User Fields (CVE-2025-40892, CVE-2025-40899, CVE-2025-40900)** (`TL-2026-5489-SPL-001`)

Detects HTML/JavaScript and Angular template-injection payloads submitted to Nozomi Guardian/CMC (RUGGEDCOM APE1808, SSA-827968) report, custom-field, user, credential, snapshot and schedule endpoints. These are the stored XSS / HTML injection flaws (CVE-2025-40892, CVE-2025-40899, CVE-2025-40900, CVE-2025-40891, CVE-2025-40901 to 40904) that execute in the browser of any user viewing or importing the object. Requires HTTP request-body visibility (Splunk Stream, WAF or reverse-proxy form logging) in front of the management interface.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.007, T1565.001, T1204.001
- **Data sources:** splunk_stream_http, waf_or_reverse_proxy_logs, nozomi_guardian_web_access
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype="stream:http" http_method IN ("POST","PUT","PATCH") (site="*guardian*" OR site="*nozomi*" OR site="*cmc*")
(uri_path="*report*" OR uri_path="*custom_field*" OR uri_path="*nodes*" OR uri_path="*credential*" OR uri_path="*users*" OR uri_path="*smart_polling*" OR uri_path="*snapshot*" OR uri_path="*schedule*")
| eval payload=urldecode(coalesce(form_data, "") . " " . coalesce(uri_query, ""))
| where match(payload, "(?i)([<](script|iframe|svg|img)|onerror\s*=|onload\s*=|javascript:|\{\{[^}]*(constructor|\$eval|\$on))")
| eval cve_hint=case(match(uri_path,"(?i)report"),"CVE-2025-40892/CVE-2025-40900", match(uri_path,"(?i)custom_field|nodes"),"CVE-2025-40899", match(uri_path,"(?i)credential"),"CVE-2025-40901", match(uri_path,"(?i)users"),"CVE-2025-40902", true(),"CVE-2025-40891/40903/40904")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uris values(cve_hint) as cve_hint by src_ip site
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod in~ ("POST", "PUT", "PATCH")
| where DestinationHostName has_any ("guardian", "nozomi", "cmc") or DeviceProduct has "Nozomi"
| where RequestURL has_any ("report", "custom_field", "nodes", "credential", "users", "smart_polling", "snapshot", "schedule")
| extend Payload = url_decode(strcat(RequestURL, " ", AdditionalExtensions))
| where Payload matches regex @'(?i)([<](script|iframe|svg|img)|onerror\s*=|onload\s*=|javascript:|\{\{[^}]*(constructor|\$eval|\$on))'
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, SourceUserName, RequestMethod, RequestURL, Payload
```

### Sigma

```yaml
title: Nozomi Guardian/CMC Stored XSS or Template Injection Payload in Management Requests
id: 3b8f6a52-1c0e-4d7a-9b41-5e2a7c9d1f01
status: experimental
description: Detects script, HTML event-handler or Angular template-injection payloads submitted to Nozomi Guardian/CMC report, asset custom-field, user, credential and snapshot endpoints (CVE-2025-40892, CVE-2025-40899, CVE-2025-40900, CVE-2025-40891, CVE-2025-40901 to CVE-2025-40904).
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-827968.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059.007
    - attack.impact
    - attack.t1565.001
    - attack.t1204.001
    - cve.2025.40892
    - cve.2025.40899
    - cve.2025.40900
logsource:
    category: webserver
detection:
    selection_method:
        cs-method:
            - 'POST'
            - 'PUT'
            - 'PATCH'
    selection_uri:
        c-uri|contains:
            - 'report'
            - 'custom_field'
            - 'nodes'
            - 'credential'
            - 'users'
            - 'smart_polling'
            - 'snapshot'
            - 'schedule'
    selection_payload:
        cs-uri-query|contains:
            - '<script'
            - '%3Cscript'
            - '<iframe'
            - '<svg'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - '{{constructor'
            - '$eval'
    condition: selection_method and selection_uri and selection_payload
falsepositives:
    - Administrators pasting HTML snippets into report descriptions
    - Vulnerability scanners probing the management interface
level: high

```

**Known false positives:**

- Administrators pasting HTML snippets into report descriptions or asset custom fields
- Authorised vulnerability scanners or pentests against the management interface

**Tuning notes:** Replace the site= host filters with the real Guardian/CMC FQDNs; exclude scanner source IPs; if request bodies are not logged the rule only sees URL-borne payloads, so enable body capture on the reverse proxy/WAF. Alert at critical when the source user holds report privileges but is not on the report-author roster.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Nozomi Guardian/CMC Arc Data Archive Import Path Traversal (CVE-2025-40898) (locked: unlock with TL Creds)
- Nozomi Guardian/CMC SSH Key Sync Endpoint Enumeration (CVE-2026-31983) (locked: unlock with TL Creds)
- Nozomi Guardian/CMC Admin CLI Commands Pushed Through Arc Sensor Sync (CVE-2026-33390) (locked: unlock with TL Creds)
- HTML/Script Markup in Crafted Network Traffic Targeting Nozomi Asset List (CVE-2025-40893) (locked: unlock with TL Creds)
- Nozomi Guardian/CMC Management Interface Accessed from Untrusted Network (SSA-827968) (locked: unlock with TL Creds)
- Nozomi Guardian/CMC SAML SSO External Redirect Poisoning (CVE-2026-31982) (locked: unlock with TL Creds)
- Nozomi Guardian/CMC View-Only Threat Intelligence User Performing Administrative Actions (CVE-2025-40897) (locked: unlock with TL Creds)
- Nozomi Guardian/CMC Oversized Request Flood — Audit Log Disk Exhaustion DoS (CVE-2026-31984) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Siemens SSA-827968: Vulnerability in Nozomi Guardian/CMC Before V26.2.0 on RUGGEDCOM APE1808 Devices](https://cert-portal.siemens.com/productcert/html/ssa-827968.html)
- [Nozomi Networks Product Security Incident Response Team Portal](https://security.nozominetworks.com/)
- [NN-2026:11-01 DoS through oversized audit log entries in Guardian/CMC before 26.2.0 (CVE-2026-31984)](https://security.nozominetworks.com/NN-2026:11-01)
- [NN-2026:13-01 Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0 (CVE-2026-33390)](https://security.nozominetworks.com/NN-2026:13-01)
- [NN-2025:13-01 Stored XSS in Reports (CVE-2025-40892)](https://security.nozominetworks.com/NN-2025:13-01)
- [GCVE record for CVE-2025-40892](https://db.gcve.eu/vuln/cve-2025-40892)
- [CVE-2026-33390 analysis (Lutra Security Field Guide)](https://fieldguide.lutrasecurity.com/CVE-2026-33390/)
- [OpenCVE CVE-2026-31984](https://app.opencve.io/cve/CVE-2026-31984)
- [INCIBE-CERT early warning CVE-2026-31984](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2026-31984)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5489