CVE-2025-40898: Nozominetworks Cmc

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in arbitrary paths, altering the device configuration and/or affecting its availability.

Affected products

• Nozominetworks Cmc: before 25.5.0 (fixed in 25.5.0)
• Nozominetworks Guardian: before 25.5.0 (fixed in 25.5.0)

Published 2025-12-18. Last modified 2026-06-17.