Nozomi Networks Guardian CVE-2025-40889

Exploitation requires an authenticated account with limited privileges on a Nozomi Networks Guardian or CMC appliance and a specifically-crafted request to the Time Machine functionality that manipulates two input parameters lacking path-traversal validation. The limiting factors are: valid authentication is mandatory (PR:L - not exploitable by anonymous/unauthenticated attackers), the attack targets the specific Time Machine feature rather than the whole product, and impact is confined to file structure/content/availability under the /data folder with no confidentiality exposure. There is no user-interaction requirement and no non-default configuration noted, so any environment granting low-privilege accounts is in scope.

This is a moderate, authenticated-only integrity/availability flaw rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reach, low attack complexity, no user interaction, and - critically - PR:L, meaning a valid low-privileged account is a hard prerequisite; the description's 'authenticated user with limited privileges' corroborates this, so the signals are consistent (no network-vs-local contradiction). Impact is scoped to VI:H/VA:H with VC:N, i.e. attackers can corrupt or delete files in /data and degrade availability but cannot read confidential data, which keeps this below a confidentiality-breach crisis. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or opportunistic exploitation; combined with the low real-world deployment footprint of OT-monitoring appliances, this is a 'patch in normal cycle' priority for affected operators rather than a drop-everything issue - though for the ICS/OT environments where Guardian/CMC run, integrity corruption of captured data is operationally significant. The 7.2 score is driven mainly by low complexity and dual high impact, not by ease of unauthenticated access.

A low-privileged but authenticated user of a Nozomi Guardian or CMC appliance sends a specially crafted request to the Time Machine feature with manipulated input parameters that are not validated for path traversal sequences. By escaping the intended directory, the attacker overwrites, alters, or deletes files under the /data folder, corrupting stored data or rendering it unavailable. No public exploit code was identified at time of analysis, and exploitation requires a working account on the appliance.