Vulnerability Description
A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated user with limited privileges, by uploading a specifically-crafted Arc data archive, can potentially write arbitrary files in arbitrary paths, altering the device configuration and/or affecting its availability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nozominetworks | Cmc | < 25.5.0 |
| Nozominetworks | Guardian | < 25.5.0 |
Related Weaknesses (CWE)
References
- https://security.nozominetworks.com/NN-2025:15-01MitigationVendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-827968.html
FAQ
What is CVE-2025-40898?
CVE-2025-40898 is a vulnerability with a CVSS score of 8.1 (HIGH). A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated user with limited privileges, by uploading...
How severe is CVE-2025-40898?
CVE-2025-40898 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-40898?
Check the references section above for vendor advisories and patch information. Affected products include: Nozominetworks Cmc, Nozominetworks Guardian.