high8.1
CVE-2025-40898
A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file.
Impact
A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in arbitrary paths, altering the device configuration and/or affecting its availability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nozominetworks | Cmc | before 25.5.0 |
| Nozominetworks | Guardian | before 25.5.0 |