CVE-2025-3718 — Client-side path traversal in Guardian/CMC before 25.2.0

CVE-2025-3718

Client-side path traversal in Guardian/CMC before 25.2.0 PUBLISHED

Description (CNA)

A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authenticated user with limited privileges can craft a malicious URL which, if visited by an authenticated victim, leads to a Cross-Site Scripting (XSS) attack.

Affected (CNA)

Vendor / product	Versions
Nozomi Networks / Guardian	affected 0 before 25.2.0
Nozomi Networks / CMC	affected 0 before 25.2.0

CWE

CWE-22

References

https://security.nozominetworks.com/NN-2025:4-01

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.