Vulnerability · Published Oct 7, 2025 · Assigned by Nozomi
CVE-2025-40889Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0
High 8.1
In plain English
A high-severity path traversal in CMC from Nozomi Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 63.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenticated user with limited privileges, by issuing a specifically-crafted request, can potentially alter the structure and content of files in the /data folder, and/or affect their availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Nozomi Networks | Guardian | 0 – before 25.2.0 |
| Nozomi Networks | CMC | 0 – before 25.2.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H