Cmc CVE-2025-40898

This vulnerability presents moderate-to-high real-world risk for organizations using Nozomi Networks products. The CVSS 7.2 score reflects significant potential impact through integrity compromise and availability disruption. Attack complexity is low (AC:L) with no user interaction required (UI:N), meaning exploitation is straightforward once authenticated access is obtained. The PR:L requirement indicates any low-privilege authenticated user can exploit this, not just administrators, significantly expanding the threat surface to include compromised limited-privilege accounts, malicious insiders, or accounts obtained through credential stuffing. No public exploit identified at time of analysis, and no CISA KEV listing indicates this is not yet confirmed as actively exploited in the wild. However, path traversal vulnerabilities are well-understood and relatively simple to exploit with basic file archive manipulation tools. The industrial control system (ICS) and operational technology (OT) monitoring context of these products elevates risk, as configuration tampering could disable security monitoring or enable further attacks on protected industrial networks. SSVC analysis suggests medium priority: exploitation requires authentication (not fully automatable), technical impact is partial (integrity/availability but not confidentiality), and no evidence of active exploitation. Organizations using these products in critical infrastructure or industrial environments should prioritize patching due to the sensitive nature of the deployed environment and potential for cascading security failures if monitoring systems are compromised.

An attacker who has compromised a low-privilege user account on the Nozomi Networks CMC or Guardian platform, or a malicious insider with limited system access, creates a specially-crafted Arc data archive containing files with path traversal sequences such as '../../../../etc/cron.daily/malicious-script' or paths targeting application configuration directories. Upon uploading and importing this malicious archive through the legitimate Arc import functionality, the application writes the attacker-controlled files to arbitrary system locations. The attacker overwrites critical configuration files to disable security monitoring, plants persistent backdoor scripts in startup directories, or corrupts application binaries to cause denial of service, all without requiring elevated privileges or complex exploitation techniques.