CVE-2026-33389
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality. Encrypted connections to target devices were established without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker can impersonate the device during a polling session and intercept communication, including credentials.
Risk Assessment
Captured credentials can be replayed to authenticate against the device or other devices sharing the same credentials, allowing the attacker to access, tamper with data, and disrupt operations.
Recommendation
It is recommended to apply the vendor's patch that adds host identity validation and provides an option to enable it.
Other vulnerabilities in Smart Polling
Original NVD description (English source)
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS