CVE-2025-40898
Unknown Unknown - Not Provided
Path Traversal in Arc Data Import Allows Arbitrary File Write

Publication date: 2025-12-18

Last updated on: 2026-04-14

Assigner: Nozomi Networks Inc.

Description
A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in arbitrary paths, altering the device configuration and/or affecting its availability.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-18
Last Modified
2026-04-14
Generated
2026-06-16
AI Q&A
2025-12-18
EPSS Evaluated
2026-06-14
NVD
CVE-2025-40898
EUVD
EUVD-2025-204258
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
nozominetworks cmc *
nozominetworks guardian *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-40898 is a path traversal vulnerability in the Import Arc data archive functionality of Nozomi Networks Guardian and CMC products before version 25.5.0. It occurs because the system does not properly validate the input file. An authenticated user with limited privileges can upload a specially crafted Arc data archive that allows them to write arbitrary files to arbitrary paths on the device. This can lead to modification of device configurations or affect the device's availability. [1]

Impact Analysis

This vulnerability can allow an authenticated user with limited privileges to write arbitrary files anywhere on the device, potentially altering device configurations or disrupting device availability. This could lead to unauthorized changes in system behavior, service interruptions, or denial of service conditions. [1]

Mitigation Strategies

Immediate mitigation steps include restricting access to the web management interface using internal firewall rules and reviewing or removing unnecessary user accounts. The definitive solution is to upgrade the affected products to version 25.5.0 or later. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-40898. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart