high7.9
CVE-2025-3718
A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter.
Impact
A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authenticated user with limited privileges can craft a malicious URL which, if visited by an authenticated victim, leads to a Cross-Site Scripting (XSS) attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nozominetworks | Cmc | before 25.2.0 |
| Nozominetworks | Guardian | before 25.2.0 |