← CVE Intelligence

CVE-2025-40898

Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0 PUBLISHED

Description (CNA)

A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in arbitrary paths, altering the device configuration and/or affecting its availability.

Affected (CNA)

Vendor / productVersions
Nozomi Networks / Guardianaffected 0 before 25.5.0
Nozomi Networks / CMCaffected 0 before 25.5.0

CWE

CWE-22

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

siemens-SADP

No English description supplied.