CVE-2026-33389
Medium5.3An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.
- CVSS
- 5.3v4.0
- EPSS (exploit probability)
- 0.2%6th pct
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-10-22 | 0.2% | 5.7% |
| 2026-10-21 | 0.2% | 5.7% |
| 2026-10-20 | 0.2% | 5.6% |
| 2026-10-19 | 0.2% | 5.6% |
| 2026-10-18 | 0.2% | 5.6% |
| 2026-10-17 | 0.2% | 5.6% |
| 2026-10-16 | 0.2% | 5.6% |
| 2026-10-15 | 0.2% | 5.6% |
| 2026-10-14 | 0.2% | 4.5% |
| 2026-10-13 | 0.2% | 4.5% |
| 2026-10-12 | 0.2% | 4.5% |
| 2026-10-11 | 0.2% | 4.5% |
| 2026-10-10 | 0.2% | 4.5% |
| 2026-10-09 | 0.2% | 4.4% |
| 2026-10-08 | 0.2% | 4.4% |
| 2026-10-07 | 0.2% | 4.4% |
| 2026-10-06 | 0.2% | 4.4% |
| 2026-10-05 | 0.2% | 4.4% |
| 2026-10-04 | 0.2% | 4.4% |
| 2026-10-03 | 0.2% | 4.4% |
| 2026-10-02 | 0.2% | 4.4% |
| 2026-10-01 | 0.2% | 4.3% |
| 2026-09-30 | 0.2% | 4.4% |
| 2026-09-29 | 0.2% | 4.3% |
| 2026-09-27 | 0.2% | 4.3% |
| 2026-09-26 | 0.2% | 4.3% |
| 2026-09-25 | 0.2% | 4.3% |
| 2026-09-24 | 0.2% | 4.2% |
| 2026-09-23 | 0.1% | 2.0% |
| 2026-09-22 | 0.1% | 2.0% |
| 2026-09-21 | 0.1% | 2.0% |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X