A path traversal flaw in the Import Arc data archive feature allows an authenticated user with limited privileges to upload a specially crafted archive. The uploader’s input is insufficiently validated, enabling the write of files to arbitrary filesystem locations. This can change the device configuration or disrupt operation, potentially leading to broader compromise if configuration files control executable components.

Nozomi Networks CMC and Guardian products are affected for all releases prior to version 25.5.0. The vulnerability exists across both product lines and is active until the vendor releases a patch in version 25.5.0 or later.

The CVSS score of 7.2 classifies this as high severity, while the EPSS score of less than 1% indicates a low exploitation likelihood as of now. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to authenticate to the web management interface and upload a malicious archive, so the attack vector is assumed to be the web interface with limited‑privilege accounts.