CVE-2025-40889

HighCVSS 8.1/10Last modified Oct 18, 2026

Description

A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenticated user with limited privileges, by issuing a specifically-crafted request, can potentially alter the structure and content of files in the /data folder, and/or affect their availability.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Nozomi Networks	Guardian	< 25.2.0
Nozomi Networks	CMC	< 25.2.0

References

https://security.nozominetworks.com/NN-2025:9-01Vendor Advisory

Timeline

Published: Oct 7, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-40895.1Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, po CVE-2025-408907.9A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.CVE-2025-408914.7A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network t CVE-2025-408928.9A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An CVE-2025-408936.1A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An CVE-2025-408945.4A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input par CVE-2025-408954.8A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map functionality due to improper validation on connected Guardians CVE-2025-408964.8The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-mi CVE-2025-408978.1An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being prope CVE-2025-408988.1A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file.CVE-2025-408998.9A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input para CVE-2025-40905.3A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability