{"document":{"aggregate_severity":{"text":"HIGH"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE"}},"lang":"en-US","notes":[{"category":"other","text":"Medium","title":"Risk Level for Nozomi customers"}],"publisher":{"category":"vendor","contact_details":"Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com","name":"Nozomi Networks Product Security","namespace":"https://security.nozominetworks.com/psirt"},"title":"Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0","tracking":{"aliases":["CVE-2025-40898"],"current_release_date":"2025-12-18T11:00:00.000Z","id":"NN-2025:15-01","initial_release_date":"2025-12-18T11:00:00.000Z","revision_history":[{"date":"2025-12-18T11:00:00.000Z","number":"1","summary":"Initial revision"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"vers:gem/<25.5.0","product":{"name":"Nozomi Networks Guardian <25.5.0","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"25.5.0","product":{"name":"Nozomi Networks Guardian 25.5.0","product_id":"CSAFPID-0002"}}],"category":"product_name","name":"Guardian"},{"branches":[{"category":"product_version_range","name":"vers:gem/<25.5.0","product":{"name":"Nozomi Networks CMC <25.5.0","product_id":"CSAFPID-0003"}},{"category":"product_version","name":"25.5.0","product":{"name":"Nozomi Networks CMC 25.5.0","product_id":"CSAFPID-0004"}}],"category":"product_name","name":"CMC"}],"category":"vendor","name":"Nozomi Networks"}]},"vulnerabilities":[{"acknowledgments":[{"names":["Andrea Palanca"],"organization":"Nozomi Networks Product Security team","summary":"finding this issue during an internal investigation"}],"cve":"CVE-2025-40898","cwe":{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"},"discovery_date":"2025-12-18T11:00:00.000Z","ids":[{"system_name":"Nozomi Networks Security Advisory ID","text":"NN-2025:15-01"}],"notes":[{"category":"summary","text":"A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file.","title":"Vulnerability summary"}],"product_status":{"fixed":["CSAFPID-0002","CSAFPID-0004"],"known_affected":["CSAFPID-0001","CSAFPID-0003"]},"references":[{"category":"external","summary":"Mitre CVE entry","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40898"},{"category":"self","summary":"Canonical URL","url":"https://security.nozominetworks.com/csaf/2025/nn-2025_15-01.json"},{"category":"self","summary":"Human-readable advisory.","url":"https://security.nozominetworks.com/NN-2025:15-01"}],"remediations":[{"category":"mitigation","details":"Use internal firewall features to limit access to the web management interface. Review all accounts with access to it and delete unnecessary ones.","product_ids":["CSAFPID-0001","CSAFPID-0003"]},{"category":"vendor_fix","details":"Upgrade to v25.5.0 or later.","product_ids":["CSAFPID-0001","CSAFPID-0003"]}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["CSAFPID-0001","CSAFPID-0003"]}],"threats":[{"category":"impact","details":"An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in arbitrary paths, altering the device configuration and/or affecting its availability."}],"title":"Path traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.0"}]}