CVE-2025-40898: 
NixOS vulnerability analysis and mitigation

CVE-2025-40898 is a path traversal vulnerability in the Import Arc data archive functionality of Nozomi Networks Guardian and CMC (Central Management Console). Due to insufficient validation of uploaded archive files, an authenticated user with limited privileges can write arbitrary files to arbitrary paths on the device. All versions of Guardian and CMC prior to 25.5.0 are affected. The vulnerability was published on December 18, 2025, with a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.2 (High) (Nozomi Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'). The root cause is insufficient validation of file paths within uploaded Arc data archives, allowing path traversal sequences (e.g., ../) to escape the intended extraction directory. An authenticated attacker with low privileges can craft a malicious Arc archive containing files with traversal sequences in their names or paths, then upload it via the Import Arc functionality. Upon extraction, the application writes files to attacker-controlled locations on the filesystem without proper sanitization (Nozomi Advisory).

Successful exploitation allows an authenticated low-privilege attacker to write arbitrary files to any location on the affected device, enabling modification of device configuration files and potentially rendering the device inoperative. The vulnerability carries HIGH integrity and HIGH availability impact, with no confidentiality impact, as attackers can overwrite critical system files or configuration data but cannot directly read sensitive information through this vector. Given that Nozomi Networks Guardian and CMC are OT/ICS network monitoring platforms, compromise of these devices could undermine visibility into industrial control system environments (Nozomi Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of publication (Nozomi Advisory). The vulnerability requires authentication with at least low-level privileges, which limits the attack surface compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a Nozomi Networks Guardian or CMC instance running a version prior to 25.5.0 that is accessible over the network.
2. Authentication: Log in to the web interface using any valid account with at least limited (low) privileges — no administrative access is required.
3. Craft malicious archive: Create a specially crafted Arc data archive containing one or more files with path traversal sequences in their filenames or internal paths (e.g., ../../etc/cron.d/malicious or ../../etc/nozomi/config.conf), designed to write to a target location outside the intended extraction directory.
4. Upload archive: Navigate to the Import Arc data archive functionality within the application and upload the crafted archive file.
5. Trigger extraction: Submit the upload; the application extracts the archive without adequately sanitizing file paths, causing files to be written to attacker-specified locations on the filesystem.
6. Achieve objective: Depending on the target path chosen, the attacker can overwrite configuration files to alter device behavior, inject scripts for persistent access, or corrupt critical files to disrupt device availability (Nozomi Advisory).

• Logs: Application or web server logs showing authenticated POST requests to the Import Arc upload endpoint from unexpected or low-privilege user accounts; repeated upload attempts with unusual archive filenames.
• File System: Presence of unexpected files in system directories (e.g., /etc/, /var/, configuration directories) with recent modification timestamps coinciding with archive import activity; files with names or content inconsistent with normal Nozomi application data.
• Process/Configuration: Unexpected changes to device configuration files or system settings following an archive import operation; device instability or service disruptions occurring shortly after an import event.

Nozomi Networks has released a patch in version 25.5.0 of both Guardian and CMC; all users should upgrade immediately (Nozomi Advisory). As interim mitigations, restrict access to the Import Arc functionality to trusted administrators only and enforce strict role-based access controls to limit which accounts can perform archive imports. Monitor system logs for suspicious file write operations in unexpected directories, and consider restricting network access to the import functionality until patching is complete.

The vulnerability was noted in CISA's weekly vulnerability bulletin for the week of December 15, 2025, indicating it received standard government-level tracking attention. Social media activity was limited, with brief mentions on infosec community platforms such as Mastodon. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator reporting.