Description

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker positioned between a sensor and a polled device can, during a polling session, impersonate the device and intercept the communication, including the credentials used to access it. The captured credentials can then be replayed to authenticate against the device itself or against other devices sharing the same credentials, allowing the attacker to access and tamper with the device's data and to disrupt its operations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-08T14:17:22.390Z",
  "pubdate": "2026-09-08T14:17:22.390Z",
  "executiveSummary": "A critical improper certificate validation vulnerability exists within the Smart Polling functionality, exposing encrypted connections to Man-in-the-Middle (MitM) attacks.\nThe vulnerability occurs because the system fails to verify the authenticity of remote host certificates during the establishment of encrypted sessions, with no available configuration to enforce validation.\nAn attacker positioned on the network path between the sensor and the polled device can intercept or redirect communication, effectively impersonating the target device.\nThe primary impact includes the unauthorized interception of sensitive data, including administrative credentials used for device authentication.\nExploitation allows for credential replay attacks, potentially granting the attacker unauthorized access to the target device or other assets sharing identical authentication tokens.\nSuccessful compromise results in the loss of confidentiality, integrity, and availability, as attackers can tamper with device data or disrupt critical operational services.\nThis flaw represents a significant risk to network security, particularly in environments where sensors rely on Smart Polling to perform automated management tasks.",
  "technicalDetails": "The root cause of this vulnerability is the absence of X.509 certificate validation logic within the Smart Polling communication module. During the TLS/SSL handshake, the client fails to perform essential checks such as verifying the server certificate chain, validating the Common Name (CN) or Subject Alternative Name (SAN), and confirming that the certificate is signed by a trusted Certificate Authority (CA).\nFurthermore, the application provides no mechanism or administrative interface to enable strict certificate pinning or host key verification, effectively rendering the encrypted channel susceptible to transparent interception.\nThe exploitation flow proceeds as follows: 1. The attacker performs network-level redirection (e.g., ARP spoofing, DNS poisoning, or BGP hijacking) to position themselves as a proxy between the sensor and the target device. 2. When the sensor initiates a Smart Polling request, the attacker intercepts the connection request. 3. The attacker presents a self-signed or otherwise untrusted certificate to the sensor. 4. Due to the lack of validation, the sensor accepts the fraudulent certificate and establishes an encrypted session with the attacker's machine. 5. The attacker decrypts the traffic, logs the plaintext credentials used for device authentication, and then forwards the request to the legitimate target to avoid suspicion.\nOnce the credentials are captured, the attacker can execute replay attacks against the target device or perform horizontal movement within the infrastructure if credentials are reused across multiple devices. The lack of mutual authentication or identity verification permits an unauthorized actor to masquerade as the polling sensor or the target device itself.\nThe impact of this vulnerability extends beyond simple eavesdropping. By successfully intercepting the management session, an attacker can manipulate polling data, inject malicious commands, or trigger administrative actions that lead to device disruption or complete system takeover. Because the protocol relies on the assumption of a secure channel without verifying the peer, the 'encrypted' nature of the connection provides a false sense of security that facilitates rather than prevents exploitation.\nThis vulnerability is inherent to the Smart Polling component's architectural design regarding TLS/SSL session establishment. It does not require prior authentication or elevated privileges by the attacker, as the attack is initiated against the network-level communication protocol itself."
}