CVE-2026-33387–33920: Siemens RUGGEDCOM APE1808 (Nozomi Guardian/CMC) — Detection and Remediation Guide for ICS Defenders

CISA has published ICSA-26-295-18 covering five vulnerabilities disclosed by Nozomi Networks that affect the Nozomi Guardian and Central Management Console (CMC) software as delivered on the Siemens RUGGEDCOM APE1808 application hosting platform — all versions of the APE1808 image are listed as affected. The vulnerability classes are not exotic memory corruption; they are web-application logic flaws in the very console your SOC uses to monitor the plant: Server-Side Template Injection (Improper Neutralization of Special Elements Used in a Template Engine), Incorrect Authorization, Lack of Administrator Control over Security, and Cross-Site Request Forgery. The highest-rated issue carries a CVSS v3 base score of 7.5 (High).

This should get your attention for a specific reason: the APE1808 is not just another endpoint. It is a DIN-rail-mounted x86 platform deployed inside the OT network, typically alongside RUGGEDCOM switches, whose entire purpose is hosting network-visibility sensors like Nozomi Guardian. An attacker who compromises the Guardian/CMC instance on an APE1808 gains a foothold on a device that (a) sits at Layer 2 with passive visibility into OT traffic, (b) is often whitelisted through every firewall rule in the zone because it 'needs to see everything,' and (c) is frequently excluded from EDR coverage because it's an 'appliance.' That is a nearly ideal staging host for lateral movement into an industrial environment.

Technical Analysis

Affected Products and Versions

• Siemens RUGGEDCOM APE1808 — all versions (vers:all/*) when running Nozomi Guardian / CMC
• The underlying vulnerabilities reside in the Nozomi Networks Guardian / Central Management Console software; the Siemens advisory maps the Nozomi disclosure to Siemens industrial products shipping it
• CVEs: CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, CVE-2026-33920
• Max CVSS v3: 7.5 (High)
• Critical Infrastructure Sectors: Critical Manufacturing and related OT environments

Vulnerability Classes and Attack Chain

Because CISA's advisory summarizes classes rather than publishing per-CVE exploit detail, defenders should reason about the classes and where they land in an attack chain:

1. Server-Side Template Injection (SSTI). The appliance's web interface passes attacker-controlled input into a server-side template engine without neutralization. SSTI in engines like Jinja2, Freemarker, or Velocity commonly escalates from expression evaluation (e.g., {{7*7}}) to full remote code execution in the context of the web service account — often root on embedded appliances. Exploitation requires only HTTP reachability to the management interface and, depending on where the injectable field lives, may be pre-authentication.

2. Incorrect Authorization. Endpoints or functions that fail to verify the caller's role, allowing a low-privileged (or unauthenticated) user to invoke administrative operations — reconfiguring sensors, exporting captured traffic, modifying users, or disabling detection rules. On an OT visibility platform, this is the 'blind the SOC' primitive.

3. Lack of Administrator Control over Security. Security-relevant settings that cannot be enforced or audited by the administrator — meaning even a well-run deployment cannot fully compensate for the weakness via configuration alone.

4. Cross-Site Request Forgery (CSRF). State-changing requests to the Guardian/CMC console lack anti-CSRF tokens, so an authenticated admin browsing attacker-controlled content can be tricked into silently executing privileged actions against the console.

A realistic chain in a targeted OT intrusion: attacker reaches the Guardian web UI across a poorly segmented IT/OT boundary or via a compromised engineering workstation → exploits SSTI for code execution on the APE1808 → uses incorrect-authorization flaws to tamper with Guardian's detection configuration (suppressing alerts on subsequent OT reconnaissance) → pivots from the sensor's privileged network position into the cell/area zone.

Exploitation Status

As of this writing, neither the CISA advisory nor the vendor materials report confirmed in-the-wild exploitation, and none of the five CVEs appear in the CISA Known Exploited Vulnerabilities catalog. Public proof-of-concept code has not been widely observed. Treat this as a pre-exploitation window — historically, ICS advisories with 7.5+ web-facing flaws see PoC publication and scanning within weeks of disclosure. There is no vendor patch auto-distribution here: Siemens explicitly instructs customers to contact Siemens customer support to obtain patch and update information, so remediation will not happen unless you initiate it.

Detection & Response

The APE1808 hosts a Linux-based appliance image; the practical telemetry sources are (1) the Guardian/CMC web access logs on the appliance, (2) upstream WAF/reverse-proxy/firewall logs, and (3) Syslog/CEF forwarded into Microsoft Sentinel. The detections below target the observable behaviors of these vulnerability classes — SSTI payloads in request URIs/bodies, and anomalous state-changing requests consistent with CSRF or authorization abuse.

Sigma

---
title: SSTI Payload Attempt Against OT Management Web Interface
id: 3f8c2e91-7a44-4b6e-9d21-5c7a9f0b3e12
status: experimental
description: Detects server-side template injection probe patterns in HTTP requests directed at appliance management interfaces such as Siemens RUGGEDCOM APE1808 hosting Nozomi Guardian/CMC (ICSA-26-295-18).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - '{{'
      - '${'
      - '#{'
      - '<%='
      - '*7}'
      - '__class__'
      - 'self.__'
  selection_body:
    cs-body|contains:
      - '{{'
      - '${'
      - '#{'
      - '__import__'
      - 'os.popen'
  condition: selection_uri or selection_body
falsepositives:
  - Rare; template syntax in query strings is atypical for OT console traffic
level: high
---
title: State-Changing Request to OT Console Missing Referer (Possible CSRF)
id: 9b1d4f27-2c85-4a39-b776-8e0d2c5a9f41
status: experimental
description: Detects POST requests to administrative functions of an OT visibility console with an absent or external Referer header, consistent with cross-site request forgery against Nozomi Guardian/CMC on Siemens RUGGEDCOM APE1808 (ICSA-26-295-18).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/api/'
      - '/admin'
      - '/users'
      - '/config'
      - '/settings'
  filter_internal_referer:
    cs-referer|startswith:
      - 'https://'
  condition: selection and not filter_internal_referer
falsepositives:
  - API clients and automation scripts legitimately POST without Referer; tune filter_internal_referer to your console hostname and known automation service accounts
level: medium

KQL (Microsoft Sentinel)

This query hunts inbound web requests to APE1808 / Guardian management IPs containing SSTI probe syntax, using firewall/proxy logs ingested via CommonSecurityLog (CEF) or Syslog. Populate the watchlist or inline list with your OT sensor management addresses.

// Hunt: SSTI probe patterns in requests destined to RUGGEDCOM APE1808 / Nozomi Guardian consoles
let OTConsoles = dynamic(["10.10.20.15", "10.10.20.16"]); // replace with your APE1808/Guardian mgmt IPs
let SstiPatterns = dynamic(["{{", "${", "#{", "<%=", "__class__", "__import__", "os.popen", "*7}"]);
union isfuzzy=true
    (CommonSecurityLog
    | where DestinationIP in (OTConsoles)
    | where RequestURL has_any (SstiPatterns)
    | project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, DeviceVendor, DeviceProduct),
    (Syslog
    | where SyslogMessage has_any (SstiPatterns) and SyslogMessage has_any (OTConsoles)
    | project TimeGenerated, HostIP, ProcessName, SyslogMessage)
| sort by TimeGenerated desc

// Hunt: repeated POSTs to admin/config endpoints of OT consoles from a single source (CSRF / auth abuse)
let OTConsoles = dynamic(["10.10.20.15", "10.10.20.16"]);
CommonSecurityLog
| where DestinationIP in (OTConsoles)
| where RequestMethod =~ "POST"
| where RequestURL has_any ("/api/", "/admin", "/users", "/config", "/settings")
| summarize PostCount = count(), Endpoints = make_set(RequestURL, 20) by SourceIP, bin(TimeGenerated, 1h)
| where PostCount > 25 or array_length(Endpoints) > 5
| sort by PostCount desc

Velociraptor VQL

If you have Velociraptor (or an equivalent agent) on jump hosts or adjacent Windows/Linux systems — or shell access to the appliance's log export — hunt the appliance's exported web access logs for injection probes. This artifact scans rotated and active access logs for template-injection signatures.

-- Hunt appliance web access logs for SSTI probe signatures (ICSA-26-295-18)
-- Point glob at exported Guardian/CMC access logs collected from the APE1808
SELECT FullPath, Line, LineNumber
FROM foreach(
  row={
    SELECT FullPath
    FROM glob(globs='/var/log/nginx/access*.log')
  },
  query={
    SELECT FullPath, Line, LineNumber
    FROM parse_lines(filename=FullPath)
    WHERE Line =~ '(\\{\\{|\\$\\{|#\\{|<%=|__class__|__import__|os\\.popen)'
})
ORDER BY LineNumber

Verification & Hardening Script

Use the following on a Linux jump host with SSH access to the APE1808 (or run adapted commands directly on the appliance console) to inventory versions, confirm current build, audit local accounts, and verify management-plane restrictions. Nozomi/Siemens updates must be obtained via Siemens customer support per the advisory — this script verifies your exposure and tightens what you control today.

#!/usr/bin/env bash
# APE1808 / Nozomi Guardian exposure check and management-plane hardening verification
# Run from a secured jump host with reachability to the appliance management interface.

TARGET="$1"   # e.g. 10.10.20.15
if [ -z "$TARGET" ]; then echo "Usage: $0 <ape1808-mgmt-ip>"; exit 1; fi

echo "=== [1] Identify appliance model / firmware (via SSH) ==="
ssh -o BatchMode=yes admin@"$TARGET" 'cat /etc/os-release 2>/dev/null; uname -a; ls /opt 2>/dev/null'

echo "=== [2] Confirm Guardian/CMC component versions for support ticket ==="
ssh -o BatchMode=yes admin@"$TARGET" 'dpkg -l 2>/dev/null | grep -i -E "guardian|cmc|nozomi" ; rpm -qa 2>/dev/null | grep -i -E "guardian|cmc|nozomi"'

echo "=== [3] Audit local accounts and recent logins ==="
ssh -o BatchMode=yes admin@"$TARGET" 'cut -d: -f1,3 /etc/passwd | awk -F: "\$2==0 || \$2>=1000"; last -20 2>/dev/null'

echo "=== [4] Verify management interface is NOT reachable from untrusted segments ==="
for port in 443 8443 80 22; do
  timeout 3 bash -c "</dev/tcp/$TARGET/$port" 2>/dev/null && echo "OPEN:  $TARGET:$port  <- verify this source segment is an authorized OT mgmt VLAN" || echo "closed: $TARGET:$port"
done

echo "=== [5] Check for unexpected outbound listeners (post-compromise staging) ==="
ssh -o BatchMode=yes admin@"$TARGET" 'ss -tulnp 2>/dev/null || netstat -tulnp 2>/dev/null'

echo "=== [6] Pull recent web access logs for SSTI probe review ==="
ssh -o BatchMode=yes admin@"$TARGET" 'grep -E "\\{\\{|\\$\\{|#\\{|__class__|__import__" /var/log/nginx/access*.log /var/log/apache2/access*.log 2>/dev/null | tail -50'

echo ""
echo "NEXT STEPS: Open a Siemens support case referencing ICSA-26-295-18 / CVE-2026-33387-33920"
echo "and request the patched APE1808 / Guardian-CMC build. Record current versions from step 2."

Remediation

1. Request the patch now. Siemens does not publish a self-service update for this issue — the advisory directs customers to contact Siemens customer support for patch and update information. Open a case today referencing ICSA-26-295-18 and CVE-2026-33387 / CVE-2026-33388 / CVE-2026-33389 / CVE-2026-33391 / CVE-2026-33920. Because all versions are affected, assume you are vulnerable until support confirms otherwise.

2. Restrict management-plane exposure (compensating control). The Guardian/CMC web interface on the APE1808 should be reachable only from a dedicated, authenticated OT management VLAN — never from enterprise IT subnets, never through the IT/OT firewall as a broad permit, and absolutely never from the internet. Until patched, consider fronting the console with a reverse proxy or jump-host model that enforces strong authentication and strips template-syntax metacharacters in request parameters.

3. Enforce CSRF hygiene at the browser layer. Until the vendor ships anti-CSRF protections, require administrators to use dedicated, hardened browsers (or browser profiles) for OT console administration, prohibit general web browsing from those sessions, and log out of the Guardian console immediately after use. CSRF requires an authenticated victim — shrink the window.

4. Audit for pre-existing compromise. Review console authentication logs for unfamiliar accounts or logins, diff Guardian's detection/alert configuration against a known-good baseline (incorrect-authorization flaws could have been used to suppress rules), and inspect the appliance for unexpected listeners or outbound connections using the script above.

5. Segment and monitor the sensor itself. Treat the APE1808 as a high-value asset: alert on any traffic originating from the sensor toward OT assets (a passive monitor should rarely initiate connections into the cell/area zone), and ensure its Syslog/CEF output is flowing to your SIEM so the detections in this post actually fire.

6. Track KEV status. None of these CVEs are in CISA's Known Exploited Vulnerabilities catalog at publication time, so no BOD 22-01 deadline applies — but given the 7.5 CVSS and the pre-auth web-attack surface, monitor the KEV and the Nozomi/Siemens advisories weekly until patched.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub